@dsh-electron/dsh-plugin-multi-root-workspace 0.1.4 → 0.1.6

package/lib/sandbox-BRXl_FpF.js

@@ -0,0 +1,132 @@
+import { a as splitConfined, i as DialectUnrecognizedError, n as widenWindowsProfile, o as widenProfileArgs } from "./windows-profile-CiFsFYIV.js";
+import { SandboxUnavailableError } from "@deepseek-ai/dsh-sandbox";
+import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
+//#region src/compat/sandbox-confine.ts
+/** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
+function isThenable(value) {
+	return typeof value?.then === "function";
+}
+/**
+* Call the upstream `confine` and widen its result, preserving sync/async shape.
+*
+* @param base - the upstream `confine`, already bound to its provider.
+* @param widen - the pure transformation to apply to the upstream result. It
+*   runs exactly once per call, on whichever release; it may throw, and the
+*   throw surfaces synchronously or as a rejection to match the base shape.
+* @param argv - the caller's argv, forwarded verbatim.
+* @param policy - the per-call policy, forwarded verbatim.
+* @param signal - forwarded when the installed release accepts it.
+* @returns the widened result, in the shape the installed release uses.
+*/
+function widenConfined(base, widen, argv, policy, signal) {
+	const confined = base(argv, policy, signal);
+	return isThenable(confined) ? confined.then(widen) : widen(confined);
+}
+//#endregion
+//#region src/sandbox.ts
+/**
+* `MultiRootSandboxProvider`: the kernel-sandbox dialect provider mounted as
+* `ctx.sandbox`.
+*
+* Every confined execution in this composition funnels through `confine()` —
+* the bash executor wraps `['bash','-c',command]`, and the terminal backend
+* wraps its PTY spawn argv — so widening the grant here is what gives bash, PTY,
+* and the fs fence one and the same root set (requirement §13). The bash
+* executor itself is therefore left upstream: it never computes roots.
+*
+* POSIX widening lives in `./dialects.ts`, Windows capabilities in
+* `./windows-profile.ts` and `./windows-runner.ts`: the upstream profile builders
+* are unreachable in the published package, so the additional roots are grafted
+* onto the profile `super.confine` actually produced (recognize the dialect
+* structurally, clone its grant spelling, fail loudly when the shape is not
+* known). This class owns only the policy that decides WHEN to graft:
+*
+* 1. with no additional roots, or under any mode other than `workspace-write`,
+*    the upstream result is returned ELEMENT FOR ELEMENT — same argv, same
+*    `enforcement`, same `denialSignatures`, same `runnerFailureRules`;
+* 2. `enforcement`, `denialSignatures`, and `runnerFailureRules` are NEVER
+*    recomputed here, even when the argv is widened — the bash executor derives
+*    its denial and enforcement reporting from them;
+* 3. only `argv` may differ, and a dialect whose shape cannot be extended fails
+*    loudly (`SandboxUnavailableError`) instead of silently confining to the
+*    primary root alone.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/sandbox
+*/
+/**
+* Local process-sandbox provider over the multi-root scope. Registers as
+* `ctx.sandbox`; the runner chain, probing, denial dialects, and Windows ACL
+* grant mechanics stay the upstream implementation's.
+*/
+var MultiRootSandboxProvider = class extends LocalSandboxProvider {
+	static inject = [
+		"multiRootCompat",
+		"sandboxPolicy",
+		"multiRootScope"
+	];
+	/**
+	* Wrap `argv` so it executes confined under `policy` on this host, granting
+	* the scope's additional roots inside the SAME dialect profile.
+	*
+	* Under `read-only` nothing is added (the mode denies every write, additional
+	* roots included), and `danger-full-access` never reaches here at all: the
+	* bash executor and the PTY backend both hand their argv straight to the local
+	* runtime in that mode. Widening therefore only ever ADDS the scope's
+	* additional roots to an upstream `workspace-write` profile.
+	*
+	* The return shape is the INSTALLED upstream provider's: synchronous on a
+	* release with a synchronous `confine`, a promise on a release with an
+	* asynchronous one. `widenConfined` preserves whichever it is — see
+	* `./compat/sandbox-confine.ts`.
+	* @param argv - the exact argv the caller is about to spawn.
+	* @param policy - the file-effect policy this execution runs under.
+	* @param signal - cancellation, forwarded to releases that accept it.
+	* @returns the argv to spawn instead, plus the selected backend's facts.
+	*/
+	confine(argv, policy, signal) {
+		const base = super.confine;
+		return widenConfined(base.bind(this), (confined) => this.widenForScope(confined, argv, policy), argv, policy, signal);
+	}
+	/**
+	* Graft the scope's additional roots onto one upstream `confine` result.
+	*
+	* Pure with respect to the upstream call: it only ever reads the scope and
+	* rewrites `argv`. `enforcement`, `denialSignatures` and `runnerFailureRules`
+	* are passed through untouched, because the bash executor derives its denial
+	* and enforcement reporting from them.
+	* @param confined - the upstream result for this call.
+	* @param argv - the caller's argv, needed to re-split the wrapped form.
+	* @param policy - the per-call policy.
+	* @returns the upstream result element for element, or one with a widened argv.
+	*/
+	widenForScope(confined, argv, policy) {
+		if (policy.mode !== "workspace-write") return confined;
+		const scope = this.ctx.multiRootScope.resolve(policy);
+		if (scope.additionalRoots.length === 0) return confined;
+		try {
+			const shape = splitConfined(confined.argv, argv);
+			if (shape.dialect === "windows-acl") return {
+				...confined,
+				argv: [
+					...widenWindowsProfile(shape.profileArgs, scope.additionalRoots, scope.primaryRoot),
+					"--",
+					...argv
+				]
+			};
+			const profileArgs = widenProfileArgs(shape.dialect, shape.profileArgs, policy, scope.additionalRoots);
+			return {
+				...confined,
+				argv: [
+					...profileArgs,
+					"--",
+					...argv
+				]
+			};
+		} catch (error) {
+			if (!(error instanceof DialectUnrecognizedError)) throw error;
+			throw new SandboxUnavailableError(policy.mode, `multi-root workspace: cannot grant the additional workspace roots [${scope.additionalRoots.join(", ")}] under the primary root ${scope.primaryRoot} — ${error.message}`);
+		}
+	}
+};
+//#endregion
+export { widenConfined as n, MultiRootSandboxProvider as t };

package/lib/sandbox.js

@@ -1,2 +1,2 @@
-import { t as MultiRootSandboxProvider } from "./sandbox-D8Fw95FM.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-BRXl_FpF.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -71,7 +71,7 @@ const MULTI_ROOT_CONTEXT_NAME = "multi-root:scope";
 * @returns the stable topology sentence.
 */
 function renderWorkspaceRootsContext(primaryRoot, additionalRoots) {
-	return `Current DSH workspace roots: ${JSON.stringify(additionalRoots)} are additional roots of this session's workspace. Under workspace-write they may be modified like the session workspace; the session cwd remains the primary root (${JSON.stringify(primaryRoot)}).`;
+	return `Current DSH workspace roots: ${JSON.stringify(additionalRoots)} are additional roots of this session's workspace. Under workspace-write they may be modified like the session workspace; the session origin remains the primary root (${JSON.stringify(primaryRoot)}); changing the working directory does not change these grants.`;
 }
 /**
 * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
@@ -81,6 +81,14 @@ function renderWorkspaceRootsContext(primaryRoot, additionalRoots) {
 var MultiRootScopeService = class extends Service {
 	/** Additional roots keyed by canonical primary root; empty until roots are registered. */
 	rootsByPrimary = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	/** Observe registry publications; consumers still resolve authority from scopeOf(). */
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
 	constructor(ctx) {
 		super(ctx, "multiRootScope");
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
@@ -132,11 +140,9 @@ var MultiRootScopeService = class extends Service {
 	*/
 	setAdditionalRoots(primaryRoot, roots) {
 		const key = canonicalPath(primaryRoot);
-		if (roots.length === 0) {
-			this.rootsByPrimary.delete(key);
-			return;
-		}
-		this.rootsByPrimary.set(key, [...roots]);
+		if (roots.length === 0) this.rootsByPrimary.delete(key);
+		else this.rootsByPrimary.set(key, [...roots]);
+		for (const listener of this.listeners) listener();
 	}
 };
 //#endregion

package/lib/session-directory-BLOstut1.js

@@ -0,0 +1,9 @@
+//#region src/compat/session-directory.ts
+function effectiveDirectory(ctx, session) {
+	const service = ctx.get("workingDirectory");
+	if (service === void 0) return session.header.cwd;
+	if (typeof service.get !== "function") throw new Error("multi-root workspace: unsupported workingDirectory service");
+	return service.get(session);
+}
+//#endregion
+export { effectiveDirectory as t };

package/lib/tool-context-CpgIFcCB.js

@@ -0,0 +1,6 @@
+//#region src/compat/tool-context.ts
+function aroundTool(ctx, listener) {
+	ctx.on.call(ctx, "tools/execute", listener);
+}
+//#endregion
+export { aroundTool as t };

package/lib/types/client/RootFileTree.d.ts

@@ -0,0 +1,12 @@
+/** Lazy additional-root tree and bounded text previews; requests carry a session and exact root. */
+import { type ReactNode } from 'react';
+import type { RootEntryView } from '../contract.ts';
+import type { PanelClient } from './panel-client.ts';
+import type { Translate } from './WorkspaceFoldersAction.tsx';
+export interface RootFileTreeProps {
+    panel: PanelClient;
+    entry: RootEntryView;
+    sessionId: () => string | undefined;
+    t: Translate;
+}
+export declare function RootFileTree(props: RootFileTreeProps): ReactNode;

package/lib/types/client/WorkspaceFoldersAction.d.ts

@@ -36,8 +36,11 @@ export interface WorkspaceFoldersActionProps {
      * than a value because the selection changes while the panel stays mounted.
      */
     readonly sessionId?: () => string | undefined;
+    readonly subscribeSession?: (listener: () => void) => () => void;
     /** Whether the sidebar renders wide content (`false` in the icon rail). */
     readonly wide?: boolean;
+    /** Compact launcher in the upstream Files tab's public actions slot. */
+    readonly compact?: boolean;
 }
 /** The sidebar footer action plus the dialog it opens. */
 export declare function WorkspaceFoldersAction(props: WorkspaceFoldersActionProps): ReactNode;

package/lib/types/client/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Browser half of the multi-root workspace plugin.
  *
- * One contribution: a sidebar footer action that opens the Workspace Folders
- * dialog. Everything it needs arrives through services the composition already
+ * Sidebar footer and optional Files actions open the Workspace Folders dialog.
+ * Everything it needs arrives through services the composition already
  * provides — `slots` to contribute, `locale` for its copy, `connection` for the
  * channel to the host half, and (optionally) `uiWorkspace` for the composed
  * directory picker and the client Session Controller for the current session.
@@ -16,6 +16,17 @@
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
 import { type PanelClient } from './panel-client.ts';
 import { type Translate } from './WorkspaceFoldersAction.tsx';
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+    interface SlotMap {
+        'sidebar.right.tab.files.actions': {
+            kind: 'list';
+            scope: 'session';
+            owner: {
+                readonly absolutePath: string;
+            };
+        };
+    }
+}
 /** The footer-action cell this plugin owns. */
 export declare const SLOT_ID = "multi-root-folders";
 /** Services the client half needs before it may activate. */

package/lib/types/client/locales.d.ts

@@ -12,12 +12,19 @@
 export declare const NS = "multiRootWorkspace";
 /** Chinese copy (the canonical shape). */
 export declare const zh: {
+    'files.browse': string;
+    'files.reload': string;
+    'files.empty': string;
+    'files.truncated': string;
+    'files.previewTruncated': string;
     'action.label': string;
     'action.title': string;
     'panel.title': string;
     'panel.subtitle': string;
     'panel.primary': string;
     'panel.primaryNote': string;
+    'panel.cwd': string;
+    'panel.cwdNote': string;
     'panel.additional': string;
     'panel.empty': string;
     'panel.emptyHint': string;
@@ -66,12 +73,19 @@ export declare const zh: {
 export type Key = keyof typeof zh;
 /** English copy, pinned to the Chinese key set. */
 export declare const en: {
+    'files.browse': string;
+    'files.reload': string;
+    'files.empty': string;
+    'files.truncated': string;
+    'files.previewTruncated': string;
     'action.label': string;
     'action.title': string;
     'panel.title': string;
     'panel.subtitle': string;
     'panel.primary': string;
     'panel.primaryNote': string;
+    'panel.cwd': string;
+    'panel.cwdNote': string;
     'panel.additional': string;
     'panel.empty': string;
     'panel.emptyHint': string;

package/lib/types/client/styles.d.ts

@@ -11,4 +11,4 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/styles
  */
 /** The stylesheet text; every class is prefixed `mrfw-` to stay collision-free. */
-export declare const STYLES = "\n/* Sidebar footer row, mirroring the host ui-settings-general trigger: the row\n * wrapper overhangs each side by 2px (width calc(100% + 4px) against the\n * shell's 12px inline padding) so the icon's ink line lands at 18px from the\n * column edge \u2014 exactly where the Settings gear below sits. */\n.mrfw-triggerRow {\n  flex: none;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: calc(100% + 4px);\n  margin: 4px -2px;\n}\n\n.mrfw-triggerRow.mrfw-railRow {\n  width: 36px;\n  margin: 8px 0 10px;\n}\n\n.mrfw-trigger {\n  box-sizing: border-box;\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: auto;\n  height: 42px;\n  margin: 0;\n  padding: 0 10px 0 8px;\n  border: none;\n  border-radius: 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  text-align: left;\n  cursor: pointer;\n  overflow: hidden;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-trigger:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-triggerIcon {\n  flex: none;\n  display: inline-flex;\n}\n\n.mrfw-triggerLabel {\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.mrfw-triggerRail {\n  flex: none;\n  width: 36px;\n  height: 36px;\n  margin: 0;\n  padding: 0;\n  gap: 0;\n  border-radius: 50%;\n  justify-content: center;\n}\n\n.mrfw-overlay {\n  position: fixed;\n  inset: 0;\n  z-index: 1000;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  padding: 24px;\n}\n\n.mrfw-mask {\n  position: absolute;\n  inset: 0;\n  background: var(--dsw-alias-bg-mask-1);\n  backdrop-filter: var(--dsw-mask-blur);\n}\n\n.mrfw-dialog {\n  position: relative;\n  z-index: 1;\n  display: flex;\n  flex-direction: column;\n  width: min(640px, 100%);\n  max-height: 100%;\n  overflow: hidden;\n  border: none;\n  border-radius: 24px;\n  background: var(--dsw-alias-bg-layer-2);\n  box-shadow: var(--dsw-elevation-prominent);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  outline: none;\n}\n\n.mrfw-header {\n  flex: none;\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 8px;\n  padding: 22px 14px 12px 24px;\n}\n\n.mrfw-title {\n  margin: 0;\n  font-size: 16px;\n  line-height: 24px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-close {\n  flex: none;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 28px;\n  height: 28px;\n  border: none;\n  border-radius: 8px;\n  background: transparent;\n  cursor: pointer;\n  color: var(--dsw-alias-label-secondary);\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-close:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-body {\n  display: flex;\n  flex-direction: column;\n  min-height: 0;\n  overflow-y: auto;\n  padding: 0 24px 24px;\n}\n\n.mrfw-description {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-alert {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.mrfw-section {\n  display: flex;\n  flex-direction: column;\n}\n\n.mrfw-section + .mrfw-section {\n  margin-top: 8px;\n}\n\n.mrfw-sectionTitleRow {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  padding: 8px 0 4px;\n}\n\n.mrfw-sectionTitle {\n  font-size: 14px;\n  line-height: 22px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-sectionNote {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-row {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  padding: 12px 0;\n  border-bottom: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n.mrfw-rowBare {\n  border-bottom: none;\n}\n\n/* A root entry's two lines: the display name on top, the absolute path under\n   it in the tertiary voice (the workspace rows recipe of the host sidebar). */\n.mrfw-rootText {\n  display: flex;\n  flex: 1 1 240px;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n.mrfw-rootName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-rootPath {\n  font-family: var(--ds-font-family-code);\n  font-size: 12px;\n  line-height: 18px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-stateWarn {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.mrfw-btn {\n  display: inline-flex;\n  flex: none;\n  align-items: center;\n  justify-content: center;\n  gap: 4px;\n  height: 28px;\n  padding: 0 10px;\n  border: none;\n  border-radius: 14px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-btn:disabled {\n  cursor: not-allowed;\n  opacity: 0.4;\n}\n\n.mrfw-btnGhost:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnGhost:active:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-active);\n}\n\n.mrfw-btnDanger:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover-danger);\n}\n\n.mrfw-btnOutline {\n  border: 0.5px solid var(--dsw-alias-border-l3);\n  background: transparent;\n}\n\n.mrfw-btnOutline:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnPrimary {\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.mrfw-btnPrimary:hover:not(:disabled) {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n/* One icon-only action: a square of the capsule family, meaning in title.\n   Declared after the .mrfw-btn family so its padding wins the cascade tie:\n   the capsule's 0 10px padding would otherwise squeeze the icon glyph. */\n.mrfw-iconBtn {\n  width: 28px;\n  padding: 0;\n  border-radius: 8px;\n}\n\n.mrfw-input {\n  flex: 1 1 220px;\n  min-width: 0;\n  height: 32px;\n  padding: 0 8px;\n  border: 0.5px solid var(--dsw-alias-border-l4);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  outline: none;\n  transition: border-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-input:focus {\n  border-color: var(--dsw-alias-brand-primary);\n}\n\n.mrfw-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.mrfw-inputInline {\n  flex: 1 1 auto;\n}\n\n.mrfw-aliasEditor {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n  flex-basis: 100%;\n}\n\n.mrfw-actions {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  margin-top: 16px;\n  padding-top: 16px;\n  border-top: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n/* One control row, one height: the capsule buttons match the 32px input. */\n.mrfw-actions .mrfw-btn {\n  height: 32px;\n  border-radius: 16px;\n}\n\n.mrfw-actions .mrfw-iconBtn {\n  width: 32px;\n}\n";
+export declare const STYLES = "\n/* Sidebar footer row, mirroring the host ui-settings-general trigger: the row\n * wrapper overhangs each side by 2px (width calc(100% + 4px) against the\n * shell's 12px inline padding) so the icon's ink line lands at 18px from the\n * column edge \u2014 exactly where the Settings gear below sits. */\n.mrfw-triggerRow {\n  flex: none;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: calc(100% + 4px);\n  margin: 4px -2px;\n}\n\n.mrfw-triggerRow.mrfw-railRow {\n  width: 36px;\n  margin: 8px 0 10px;\n}\n\n.mrfw-trigger {\n  box-sizing: border-box;\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: auto;\n  height: 42px;\n  margin: 0;\n  padding: 0 10px 0 8px;\n  border: none;\n  border-radius: 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  text-align: left;\n  cursor: pointer;\n  overflow: hidden;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-trigger:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-triggerIcon {\n  flex: none;\n  display: inline-flex;\n}\n\n.mrfw-triggerLabel {\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.mrfw-triggerRail {\n  flex: none;\n  width: 36px;\n  height: 36px;\n  margin: 0;\n  padding: 0;\n  gap: 0;\n  border-radius: 50%;\n  justify-content: center;\n}\n\n.mrfw-overlay {\n  position: fixed;\n  inset: 0;\n  z-index: 1000;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  padding: 24px;\n}\n\n.mrfw-mask {\n  position: absolute;\n  inset: 0;\n  background: var(--dsw-alias-bg-mask-1);\n  backdrop-filter: var(--dsw-mask-blur);\n}\n\n.mrfw-dialog {\n  position: relative;\n  z-index: 1;\n  display: flex;\n  flex-direction: column;\n  width: min(640px, 100%);\n  max-height: 100%;\n  overflow: hidden;\n  border: none;\n  border-radius: 24px;\n  background: var(--dsw-alias-bg-layer-2);\n  box-shadow: var(--dsw-elevation-prominent);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  outline: none;\n}\n\n.mrfw-header {\n  flex: none;\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 8px;\n  padding: 22px 14px 12px 24px;\n}\n\n.mrfw-title {\n  margin: 0;\n  font-size: 16px;\n  line-height: 24px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-close {\n  flex: none;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 28px;\n  height: 28px;\n  border: none;\n  border-radius: 8px;\n  background: transparent;\n  cursor: pointer;\n  color: var(--dsw-alias-label-secondary);\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-close:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-body {\n  display: flex;\n  flex-direction: column;\n  min-height: 0;\n  overflow-y: auto;\n  padding: 0 24px 24px;\n}\n\n.mrfw-description {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-alert {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.mrfw-section {\n  display: flex;\n  flex-direction: column;\n}\n\n.mrfw-section + .mrfw-section {\n  margin-top: 8px;\n}\n\n.mrfw-sectionTitleRow {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  padding: 8px 0 4px;\n}\n\n.mrfw-sectionTitle {\n  font-size: 14px;\n  line-height: 22px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-sectionNote {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-row {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  padding: 12px 0;\n  border-bottom: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n.mrfw-rowBare {\n  border-bottom: none;\n}\n\n/* A root entry's two lines: the display name on top, the absolute path under\n   it in the tertiary voice (the workspace rows recipe of the host sidebar). */\n.mrfw-rootText {\n  display: flex;\n  flex: 1 1 240px;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n.mrfw-rootName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-rootPath {\n  font-family: var(--ds-font-family-code);\n  font-size: 12px;\n  line-height: 18px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-stateWarn {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.mrfw-btn {\n  display: inline-flex;\n  flex: none;\n  align-items: center;\n  justify-content: center;\n  gap: 4px;\n  height: 28px;\n  padding: 0 10px;\n  border: none;\n  border-radius: 14px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-btn:disabled {\n  cursor: not-allowed;\n  opacity: 0.4;\n}\n\n.mrfw-btnGhost:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnGhost:active:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-active);\n}\n\n.mrfw-btnDanger:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover-danger);\n}\n\n.mrfw-btnOutline {\n  border: 0.5px solid var(--dsw-alias-border-l3);\n  background: transparent;\n}\n\n.mrfw-btnOutline:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnPrimary {\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.mrfw-btnPrimary:hover:not(:disabled) {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n/* One icon-only action: a square of the capsule family, meaning in title.\n   Declared after the .mrfw-btn family so its padding wins the cascade tie:\n   the capsule's 0 10px padding would otherwise squeeze the icon glyph. */\n.mrfw-iconBtn {\n  width: 28px;\n  padding: 0;\n  border-radius: 8px;\n}\n\n.mrfw-input {\n  flex: 1 1 220px;\n  min-width: 0;\n  height: 32px;\n  padding: 0 8px;\n  border: 0.5px solid var(--dsw-alias-border-l4);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  outline: none;\n  transition: border-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-input:focus {\n  border-color: var(--dsw-alias-brand-primary);\n}\n\n.mrfw-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.mrfw-inputInline {\n  flex: 1 1 auto;\n}\n\n.mrfw-aliasEditor {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n  flex-basis: 100%;\n}\n\n.mrfw-actions {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  margin-top: 16px;\n  padding-top: 16px;\n  border-top: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n/* One control row, one height: the capsule buttons match the 32px input. */\n.mrfw-actions .mrfw-btn {\n  height: 32px;\n  border-radius: 16px;\n}\n\n.mrfw-fileTree { flex-basis: 100%; min-width: 0; }\n.mrfw-fileLevel { list-style: none; padding-left: 16px; margin: 4px 0; }\n.mrfw-fileEntry { display: block; border: 0; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; text-align: left; cursor: pointer; padding: 4px; overflow-wrap: anywhere; }\n.mrfw-fileEntry:focus-visible { outline: 1px solid var(--dsw-alias-brand-primary); }\n.mrfw-filePreview { max-height: 320px; overflow: auto; padding: 8px; background: var(--dsw-alias-bg-layer-1); color: var(--dsw-alias-label-primary); font-size: 12px; }\n.mrfw-actions .mrfw-iconBtn {\n  width: 32px;\n}\n";

package/lib/types/compat/client-icons.d.ts

@@ -3,7 +3,7 @@
  *
  * ```text
  * 0.1.5-rc.2 / 0.1.6   IconFolderClose16, IconChevronDownOutline14, …  (pixel size in the name)
- * 0.1.7-alpha.1 through 0.1.7-rc.2   IconFolderCloseRegular, IconChevronDownOutlineRegular, …  (weight in the name)
+ * 0.1.7-alpha.1 through 0.2.0-rc.2   IconFolderCloseRegular, IconChevronDownOutlineRegular, …  (weight in the name)
  * ```
  *
  * `0.1.7-alpha.1` kept `size` as a prop and split each glyph into a Regular

package/lib/types/compat/client-session.d.ts

@@ -30,3 +30,5 @@
  * @returns the session id, or `undefined` when no main view holds one.
  */
 export declare function currentSessionIdOf(sessions: unknown): string | undefined;
+/** Observe native catalog changes when this surface provides a subscribable store. */
+export declare function subscribeSessions(sessions: unknown, listener: () => void): () => void;

package/lib/types/compat/dsh-version.d.ts

@@ -28,7 +28,7 @@
  * the upgrade smoke passed on that exact version — a green CI run on an
  * unlisted release is evidence, not authorization (ADR-0009).
  */
-export declare const SUPPORTED_DSH_RELEASES: readonly ["0.1.5-rc.2", "0.1.6-alpha.1", "0.1.6-alpha.2", "0.1.7-alpha.1", "0.1.7-alpha.2", "0.1.7-rc.1", "0.1.7-rc.2"];
+export declare const SUPPORTED_DSH_RELEASES: readonly ["0.1.5-rc.2", "0.1.6-alpha.1", "0.1.6-alpha.2", "0.1.7-alpha.1", "0.1.7-alpha.2", "0.1.7-rc.1", "0.1.7-rc.2", "0.2.0-rc.1", "0.2.0-rc.2", "0.2.1-alpha.1", "0.2.1-alpha.2"];
 /** One release this plugin claims to support. */
 export type SupportedDshRelease = typeof SUPPORTED_DSH_RELEASES[number];
 /**
@@ -42,9 +42,11 @@ export declare const REQUIRED_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@
  * Absence is fine; a version that DISAGREES with the required packages is not —
  * that is the mixed-installation failure this contract exists to catch.
  */
-export declare const OPTIONAL_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
+export declare const OPTIONAL_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
 /** Every package the contract inspects, required first. */
-export declare const CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-fs-local", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-local", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
+export declare const CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-fs-local", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-local", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
+/** Services looked up structurally; older runtimes never install these modules. */
+export declare const HOST_RESOLVED_PACKAGES: readonly ["@deepseek-ai/dsh-working-directory"];
 /** How this plugin reacts to an installation it does not support. */
 export type CompatEnforcement = 'enforce' | 'warn';
 /** The environment variable that relaxes the gate. */

package/lib/types/compat/instruction-overlap.d.ts

@@ -0,0 +1,7 @@
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
+import type { LoadedInstructionFile } from './agent-instructions.ts';
+export interface NativeInstructionCopies {
+    pathOf: (file: LoadedInstructionFile) => string | undefined;
+    withdraws: (displayPath: string) => boolean;
+}
+export declare function nativeInstructionCopies(messages: readonly UserMessage[], cwd: string | undefined): NativeInstructionCopies;

package/lib/types/compat/session-directory.d.ts

@@ -0,0 +1,4 @@
+/** Optional upstream workingDirectory lookup; identity always stays in the Session header. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session } from '@deepseek-ai/dsh-session';
+export declare function effectiveDirectory(ctx: Context, session: Session): string | undefined;

package/lib/types/compat/tool-context.d.ts

@@ -0,0 +1,9 @@
+/** The around-dispatch seam is optional on older hosts; do not import their tool runtime. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+export interface ToolCaller {
+    readonly agent?: Agent;
+    readonly callId: string;
+    readonly name: string;
+}
+export declare function aroundTool(ctx: Context, listener: (exec: ToolCaller, next: () => Promise<unknown>) => Promise<unknown>): void;

package/lib/types/compat/tool-result.d.ts

@@ -3,7 +3,7 @@
  *
  * ```text
  * 0.1.5-rc.2 / 0.1.6   content[0].isError on the tool-result block
- * 0.1.7-alpha.1 through 0.1.7-rc.2   message.isError on the tool-role message
+ * 0.1.7-alpha.1 through 0.2.0-rc.2   message.isError on the tool-role message
  * ```
  *
  * A failed `read` / `write` / `edit` must not make a directory worth examining

package/lib/types/compat/workspace-files.d.ts

@@ -0,0 +1,5 @@
+/** Old releases watch a session; newer ones watch a path. Probe arity, never version. */
+import type { WorkspaceFiles, WorkspaceFileScope, WorkspaceFileWatchFrame } from '@deepseek-ai/dsh-api-workspace-files';
+type PathWatch = (this: WorkspaceFiles, scope: WorkspaceFileScope, path: string, signal: AbortSignal) => AsyncIterable<WorkspaceFileWatchFrame>;
+export declare function adaptPathWatch(service: WorkspaceFiles, wrap: (original: PathWatch) => PathWatch): () => void;
+export {};

package/lib/types/contract.d.ts

@@ -12,8 +12,9 @@
  * - **One shape per endpoint.** {@link PanelResponseMap} is the single mapping
  *   from endpoint to response type, so the panel cannot silently decode one
  *   endpoint's answer as another's. `reveal` answers with
- *   {@link RevealedView}; every other endpoint answers with a whole
- *   {@link RootsView}. The host builds those answers in `command.ts` and the
+ *   {@link RevealedView}; root-management endpoints answer with
+ *   {@link RootsView}, and browsing returns {@link FilesView} or {@link FilePreview}.
+ *   The host builds those answers in `command.ts` and the
  *   panel parses them here — one definition, two consumers.
  * - **Runtime validation at the boundary.** The payload arrives from a browser
  *   and the answer arrives from the host; neither is trusted to match the
@@ -30,9 +31,21 @@
 /** The absolute logical channel both halves speak over. */
 export declare const PANEL_CHANNEL = "/multi-root-workspace";
 /** Endpoint names, relative to {@link PANEL_CHANNEL}. */
-export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'reveal';
+export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'reveal' | 'files' | 'readFile';
 /** Every endpoint name, for exhaustive iteration in tests and callers. */
 export declare const PANEL_ENDPOINTS: readonly PanelEndpoint[];
+export interface FilesView {
+    readonly path: string;
+    readonly entries: readonly {
+        readonly name: string;
+        readonly type: 'file' | 'directory' | 'other';
+    }[];
+    readonly truncated: boolean;
+}
+export interface FilePreview {
+    readonly text: string;
+    readonly eof: boolean;
+}
 /**
  * How one registered root currently stands, as the panel renders it. Kept in
  * step with the root vocabulary in `src/roots.ts` deliberately: this module is
@@ -64,7 +77,7 @@ export interface RootEntryView {
     readonly path: string;
     readonly addedAt: string;
 }
-/** The panel's whole view of one workspace root; every endpoint but `reveal` answers with this. */
+/** The panel's whole view, returned by root-management endpoints. */
 export interface RootsView {
     /** The canonical workspace root these registrations belong to. */
     readonly primaryRoot: string;
@@ -74,6 +87,8 @@ export interface RootsView {
      * basename.
      */
     readonly primaryName?: string;
+    /** Execution directory only; never a registry key or an authorization grant. */
+    readonly effectiveCwd?: string;
     /** The additional roots, in registry order. */
     readonly roots: readonly RootView[];
     /** Set when the store itself could not be read; the panel shows this verbatim. */
@@ -92,6 +107,8 @@ export interface PanelResponseMap {
     readonly alias: RootsView;
     readonly move: RootsView;
     readonly reveal: RevealedView;
+    readonly files: FilesView;
+    readonly readFile: FilePreview;
 }
 /**
  * The fields a request may carry. `sessionId` is required on every endpoint:
@@ -106,7 +123,7 @@ export interface PanelRequest {
     readonly entry?: RootEntryView;
     /** Compatibility reference; accepted only when the id is unique. */
     readonly id?: string;
-    /** Candidate directory (add). */
+    /** Candidate directory (add), or root-relative browsing path (files/readFile). */
     readonly path?: string;
     /** Display alias (add/alias); empty clears it. */
     readonly alias?: string;
@@ -135,6 +152,8 @@ export type Parsed<T> = {
     readonly ok: false;
     readonly message: string;
 };
+export declare function parseFilesView(value: unknown): Parsed<FilesView>;
+export declare function parseFilePreview(value: unknown): Parsed<FilePreview>;
 /**
  * Validate the payload the host received for one endpoint.
  * @param endpoint - the endpoint the channel dispatched (the RPC method).

package/lib/types/index.d.ts

@@ -44,8 +44,8 @@ export { availableRoots, canonicalRoot, classifyStoredRoots, expandRootInput, in
 export type { AdditionalRootId, RegisteredRoot, RootRef, RootState, RootStatus, RootValidationCode, } from './roots.ts';
 export { COMMAND_NAME, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealArgv } from './command.ts';
 export type { FoldersCommand } from './command.ts';
-export { PANEL_CHANNEL, PANEL_ENDPOINTS, parsePanelCall, parseRevealedView, parseRootsView } from './contract.ts';
-export type { PanelCall, PanelEndpoint, PanelFailure, PanelRequest, PanelResponseMap, RevealedView, RootView, RootsView, } from './contract.ts';
+export { PANEL_CHANNEL, PANEL_ENDPOINTS, parsePanelCall, parseRevealedView, parseRootsView, parseFilesView, parseFilePreview } from './contract.ts';
+export type { FilesView, FilePreview, PanelCall, PanelEndpoint, PanelFailure, PanelRequest, PanelResponseMap, RevealedView, RootView, RootsView, } from './contract.ts';
 /**
  * Carrier plugin face for the bare-package-name loader row (see the module
  * doc). It deliberately provides nothing: every host responsibility is owned

package/lib/types/lsp.d.ts

@@ -0,0 +1,4 @@
+/** Add root routing at the public LSP query seam; upstream owns servers and disposal. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;

package/lib/types/method-wrapper.d.ts

@@ -0,0 +1,2 @@
+/** Wrap a public method on a Cordis service without capturing a caller-context proxy. */
+export declare function wrapMethod<T extends object, K extends keyof T>(target: T, key: K, wrap: (original: T[K]) => T[K]): () => void;

package/lib/types/panel-files.d.ts

@@ -0,0 +1,3 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { PanelCall, FilePreview, FilesView } from './contract.ts';
+export declare function browseRoot(ctx: Context, primaryRoot: string, request: PanelCall, signal: AbortSignal): Promise<FilesView | FilePreview>;

package/lib/types/sandbox.d.ts

@@ -8,7 +8,8 @@
  * and the fs fence one and the same root set (requirement §13). The bash
  * executor itself is therefore left upstream: it never computes roots.
  *
- * The widening itself lives in `./dialects.ts`: the upstream profile builders
+ * POSIX widening lives in `./dialects.ts`, Windows capabilities in
+ * `./windows-profile.ts` and `./windows-runner.ts`: the upstream profile builders
  * are unreachable in the published package, so the additional roots are grafted
  * onto the profile `super.confine` actually produced (recognize the dialect
  * structurally, clone its grant spelling, fail loudly when the shape is not
@@ -38,8 +39,6 @@ export type { Config };
  */
 export declare class MultiRootSandboxProvider extends LocalSandboxProvider {
     static inject: string[];
-    /** Whether the Windows ACL limitation has already been reported (once per provider). */
-    private warnedAboutWindowsAcl;
     /**
      * Wrap `argv` so it executes confined under `policy` on this host, granting
      * the scope's additional roots inside the SAME dialect profile.
@@ -73,13 +72,5 @@ export declare class MultiRootSandboxProvider extends LocalSandboxProvider {
      * @returns the upstream result element for element, or one with a widened argv.
      */
     private widenForScope;
-    /**
-     * Report the documented first-release limitation exactly once: the Windows ACL
-     * rung grants through per-workspace write SIDs rather than argv paths, so
-     * additional roots stay unenforced for confined commands there while the
-     * in-process filesystem fence still allows them.
-     * @param rootCount - how many additional roots the scope carries.
-     */
-    private warnAboutWindowsAcl;
 }
 export default MultiRootSandboxProvider;

package/lib/types/scope.d.ts

@@ -93,6 +93,9 @@ export declare function renderWorkspaceRootsContext(primaryRoot: string, additio
 export declare class MultiRootScopeService extends Service {
     /** Additional roots keyed by canonical primary root; empty until roots are registered. */
     private readonly rootsByPrimary;
+    private readonly listeners;
+    /** Observe registry publications; consumers still resolve authority from scopeOf(). */
+    subscribe(listener: () => void): () => void;
     constructor(ctx: Context);
     /**
      * Resolve the scope of one confined call.

package/lib/types/windows-profile.d.ts

@@ -0,0 +1,13 @@
+/** A root-set capability: removing or adding a root changes the token's identity. */
+export declare function workspaceScopeSid(roots: readonly string[]): string;
+export interface WindowsProfile {
+    workspace: string;
+    temp: string;
+    mode: 'workspace-write';
+    additionalRoots: string[];
+    writeSid?: string;
+    tempWriteSid?: string;
+}
+/** Strictly recognize the upstream public runner contract, failing closed on new flags. */
+export declare function parseWindowsProfile(args: readonly string[], allowAdditional?: boolean): WindowsProfile;
+export declare function widenWindowsProfile(profile: readonly string[], roots: readonly string[], primaryRoot?: string): string[];

package/lib/types/windows-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/workspace-files.d.ts

@@ -0,0 +1,4 @@
+/** Extend the existing workspaceFiles namespace without replacing its codecs or read caps. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;

package/lib/types/workspace-routing.d.ts

@@ -0,0 +1,11 @@
+/** Shared, canonical root selection for read-only workspace consumers. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { FsTarget } from '@deepseek-ai/dsh-fs';
+export interface WorkspaceRoute {
+    primaryRoot: string;
+    workspaceRoot: string;
+    target: FsTarget;
+    absolutePath: string;
+}
+/** Resolve relative paths against the primary cwd; never search other roots by basename. */
+export declare function routeWorkspacePath(ctx: Context, primaryRoot: string, path: string, signal?: AbortSignal, cwd?: string): Promise<WorkspaceRoute | undefined>;