@dsh-electron/dsh-plugin-multi-root-workspace 0.1.5 → 0.1.7

package/lib/types/compat/windows-native.d.ts

@@ -0,0 +1,68 @@
+export type NativePointer = unknown;
+export type NativeFunction = (...args: readonly unknown[]) => number;
+export interface NativeApi {
+    [name: string]: NativeFunction;
+}
+export interface KoffiApi {
+    decode(pointer: NativePointer, type: string, length?: number): unknown;
+    address(pointer: NativePointer): bigint;
+    load(name: string): unknown;
+    alloc(type: string, length: number): NativePointer;
+    free(pointer: NativePointer): void;
+    encode(pointer: NativePointer, type: string, value: unknown, length?: number): void;
+}
+export interface WindowsNative {
+    koffi: KoffiApi;
+    extendWin32ProcessBindings(create: (context: {
+        kernel32: unknown;
+        advapi32: unknown;
+        bind(library: unknown, name: string, result: string, args: string[]): unknown;
+    }) => NativeApi): NativeApi;
+    spawnInheritedJobProcess(api: NativeApi, options: {
+        token: NativePointer;
+        command: string;
+        args: readonly string[];
+        cwd: string;
+        controlFileDescriptor?: 7;
+    }): {
+        process: NativePointer;
+        job: NativePointer;
+    };
+    waitForProcessExit(api: NativeApi, process: NativePointer): number;
+}
+/** Decode the UTF-16 pointee, not a second string pointer stored at its first
+ * code units. `decode(ptr, 'str16')` would dereference those units as an address.
+ */
+export declare function readWindowsWideString(koffi: KoffiApi, pointer: NativePointer): string;
+export declare function loadWindowsNative(upstreamRunner: string): Promise<WindowsNative>;
+/** Older public process helpers predate fd-7 CRT forwarding. Adapt the Win32
+ * STARTUPINFO structure at the public binding seam, preserving argv and Job
+ * ownership. New helpers already populate cbReserved2 and pass through.
+ */
+export declare function spawnWindowsDeniedChild(native: WindowsNative, api: NativeApi, options: Parameters<WindowsNative['spawnInheritedJobProcess']>[1], activation?: {
+    sourceToken: NativePointer;
+    assign(process: NativePointer, thread: NativePointer): void;
+}): ReturnType<WindowsNative['spawnInheritedJobProcess']>;
+/**
+ * Terminate a kill-on-close Job and wait until the kernel reports it drained.
+ *
+ * The public `waitForProcessExit` covers the direct child only: a descendant
+ * the child spawned before exiting stays in the Job and could otherwise keep
+ * running — with its restricted token — after the runner has released its
+ * ancestor pins. `TerminateJobObject(job, 127)` kills every member; the
+ * subsequent `QueryInformationJobObject` polling loop (class 1,
+ * JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, `ActiveProcesses` at byte 40) only
+ * returns once the kernel reports none left. There is deliberately no
+ * timeout: releasing pins while a live descendant remains is exactly the gap
+ * this wait exists to close. The caller still owns and closes the Job handle
+ * afterwards.
+ *
+ * Abnormal-error boundary: a TerminateJobObject or QueryInformationJobObject
+ * API failure throws into the caller's teardown — the Job handle is still
+ * closed there and its kill-on-close flag is the residual bound, same as the
+ * forced-termination case: if the runner process itself is killed, no
+ * in-process guarantee can survive, the Job flag takes the descendants down
+ * with it, and the pin handles die with the process. Protection is promised
+ * only through this orderly path.
+ */
+export declare function terminateWindowsJobAndWait(native: WindowsNative, api: NativeApi, job: NativePointer): void;

package/lib/types/compat/windows-path-guard.d.ts

@@ -0,0 +1,56 @@
+/** Windows deny-path pinning (branch-review Phase B).
+ *
+ * The ACL writer's deny ACEs follow the file OBJECT, not the registered
+ * spelling: a restricted process that renames a deny root's ancestor moves
+ * the protected tree to a NEW path the recorded deny set does not name — the
+ * kernel still refuses that token's writes through the moved ACEs, but the
+ * host fs fence, which matches the recorded spellings, no longer covers the
+ * moved objects (the shell → host new-path gap, R1). This guard pins every
+ * ancestor directory of every deny root with an open handle that shares read
+ * and write but NOT delete — so a rename or delete of the registered tree
+ * fails for the lifetime of the restricted child, without writing a single
+ * persistent ACL on `C:\`, user directories, or anywhere else.
+ *
+ * `windows-deny.ts` owns the lifetime contract: handles are held until the
+ * confined child AND its drained Job descendants have exited.
+ *
+ * Primitives are bound through the public `extendWin32ProcessBindings` seam —
+ * no upstream private file, no new native dependency. Every verification uses
+ * the same handle that pins the directory, so the checked object and the
+ * pinned object are always the same one.
+ */
+import type { NativeApi, NativePointer, WindowsNative } from './windows-native.ts';
+/** What `GetFileInformationByHandle` reports for one pinned object. */
+export interface WindowsPathIdentity {
+    readonly attributes: number;
+    readonly volumeSerial: number;
+    readonly fileIndex: bigint;
+    readonly links: number;
+}
+/** Held ancestor pins. {@link WindowsPathGuard.close} releases every handle. */
+export interface WindowsPathGuard {
+    close(): void;
+}
+/** BY_HANDLE_FILE_INFORMATION is 52 bytes (FILETIME members are DWORD-pairs):
+ * attributes @0, volume serial @28, link count @40, file index high @44 /
+ * low @48. Read back on the same handle that pins the path, so the identity
+ * cannot drift between check and pin.
+ */
+export declare function readWindowsPathIdentity(api: NativeApi, handle: NativePointer): WindowsPathIdentity;
+/**
+ * Open a pin handle on every ancestor of every deny root — including the deny
+ * root itself — and hold them all until {@link WindowsPathGuard.close}. Each
+ * handle is opened with GENERIC_READ, read+write sharing, and a null security
+ * descriptor so it is non-inheritable; the missing DELETE sharing is what
+ * blocks renames, while ordinary reads and writes (and creating sibling files
+ * inside a pinned directory) keep working.
+ *
+ * Every pin is verified on the same handle: the object must be a directory,
+ * must not be a reparse point, must not carry the inherit flag (so a confined
+ * child cannot simply `CloseHandle` the pin away), and its kernel-reported
+ * final DOS path must equal the expected canonical spelling.
+ * Any failure — open, verification, or a sharing conflict with a handle some
+ * other component already holds — closes every earlier pin in reverse order
+ * and refuses, keeping the launch fail-closed before spawn.
+ */
+export declare function pinWindowsDenyPaths(native: WindowsNative, roots: readonly string[]): WindowsPathGuard;

package/lib/types/compat/workspace-files.d.ts

@@ -0,0 +1,7 @@
+/** Old releases watch a session; newer ones watch a path. Probe arity, never version. */
+import type { WorkspaceFiles, WorkspaceFileScope, WorkspaceFileWatchFrame } from '@deepseek-ai/dsh-api-workspace-files';
+type PathWatch = (this: WorkspaceFiles, scope: WorkspaceFileScope, path: string, signal: AbortSignal) => AsyncIterable<WorkspaceFileWatchFrame>;
+export declare function adaptPathWatch(service: WorkspaceFiles, wrap: (original: PathWatch) => PathWatch): () => void;
+/** Match both legacy `readRelated` and modern `readBytes({ baseFile })` tail resolution. */
+export declare function resolveRelatedWorkspacePath(absoluteBase: string, tail: string): string;
+export {};

package/lib/types/contract.d.ts

@@ -12,8 +12,9 @@
  * - **One shape per endpoint.** {@link PanelResponseMap} is the single mapping
  *   from endpoint to response type, so the panel cannot silently decode one
  *   endpoint's answer as another's. `reveal` answers with
- *   {@link RevealedView}; every other endpoint answers with a whole
- *   {@link RootsView}. The host builds those answers in `command.ts` and the
+ *   {@link RevealedView}; root-management endpoints answer with
+ *   {@link RootsView}.
+ *   The host builds those answers in `command.ts` and the
  *   panel parses them here — one definition, two consumers.
  * - **Runtime validation at the boundary.** The payload arrives from a browser
  *   and the answer arrives from the host; neither is trusted to match the
@@ -30,7 +31,7 @@
 /** The absolute logical channel both halves speak over. */
 export declare const PANEL_CHANNEL = "/multi-root-workspace";
 /** Endpoint names, relative to {@link PANEL_CHANNEL}. */
-export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'reveal';
+export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'setAccess' | 'reveal';
 /** Every endpoint name, for exhaustive iteration in tests and callers. */
 export declare const PANEL_ENDPOINTS: readonly PanelEndpoint[];
 /**
@@ -40,6 +41,17 @@ export declare const PANEL_ENDPOINTS: readonly PanelEndpoint[];
  * value the two sides share is spelled out rather than imported.
  */
 export type RootState = 'available' | 'missing' | 'redirected' | 'invalid';
+/**
+ * The write authority one registration carries (B9 three-state), spelled out
+ * rather than imported: this module is inlined into the browser bundle and
+ * must not pull in `node:*`, so the one value the two sides share is
+ * duplicated here.
+ */
+export type RootAccess = 'inherit' | 'read-write' | 'read-only';
+export type WorkspaceMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+export type EffectiveRootAccess = 'read-only' | 'read-write' | 'full-access' | 'unavailable';
+/** The shared nine-cell rule; tool dispatch may subsequently narrow writes. */
+export declare function effectiveRootAccess(access: RootAccess, mode: WorkspaceMode): EffectiveRootAccess;
 /** One root as the panel renders it. */
 export interface RootView {
     /** 1-based position in the returned snapshot. */
@@ -54,6 +66,10 @@ export interface RootView {
     readonly addedAt: string;
     /** Whether the directory is writable right now, withheld, or unusable. */
     readonly state: RootState;
+    /** The write authority the registration carries. */
+    readonly access: RootAccess;
+    /** Host-derived session permission, before any per-tool cap. */
+    readonly effectiveAccess?: EffectiveRootAccess;
     /** Why the root is not `available`; a code the panel localizes. */
     readonly detail?: string;
 }
@@ -64,7 +80,7 @@ export interface RootEntryView {
     readonly path: string;
     readonly addedAt: string;
 }
-/** The panel's whole view of one workspace root; every endpoint but `reveal` answers with this. */
+/** The panel's whole view, returned by root-management endpoints. */
 export interface RootsView {
     /** The canonical workspace root these registrations belong to. */
     readonly primaryRoot: string;
@@ -74,8 +90,20 @@ export interface RootsView {
      * basename.
      */
     readonly primaryName?: string;
+    /** Execution directory only; never a registry key or an authorization grant. */
+    readonly effectiveCwd?: string;
+    readonly mode?: WorkspaceMode;
+    readonly cappedTools?: readonly string[];
+    readonly toolAccessInvalid?: boolean;
     /** The additional roots, in registry order. */
     readonly roots: readonly RootView[];
+    /** The host cap; MAX_SAFE_INTEGER means a legacy host reported no limit. */
+    readonly limit: number;
+    /**
+     * How many records are stored, in every state. `count > limit` is a
+     * historical over-limit store: everything stays granted, only adds refuse.
+     */
+    readonly count: number;
     /** Set when the store itself could not be read; the panel shows this verbatim. */
     readonly unavailable?: string;
 }
@@ -91,6 +119,7 @@ export interface PanelResponseMap {
     readonly remove: RootsView;
     readonly alias: RootsView;
     readonly move: RootsView;
+    readonly setAccess: RootsView;
     readonly reveal: RevealedView;
 }
 /**
@@ -110,6 +139,8 @@ export interface PanelRequest {
     readonly path?: string;
     /** Display alias (add/alias); empty clears it. */
     readonly alias?: string;
+    /** Write authority (add — defaults to `inherit` — and setAccess). */
+    readonly access?: RootAccess;
     /** Exact anchor row (move): the target is placed in front of it; absent moves it last. */
     readonly beforeEntry?: RootEntryView;
     /** Compatibility anchor; accepted only when the id is unique. */

package/lib/types/dialects.d.ts

@@ -35,16 +35,20 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/dialects
  */
 import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox';
+import { DialectUnrecognizedError } from './windows-runner-contract.ts';
 /** The kernel runner dialects a confined argv can speak. */
 export type RunnerDialect = 'seatbelt' | 'bwrap' | 'landlock' | 'windows-acl';
 /**
  * Raised when a confined argv cannot be recognized or widened. The provider
  * converts this into the fail-closed `SandboxUnavailableError`: an unrecognized
  * dialect must never degrade into "the primary root was granted after all".
+ *
+ * The class itself lives in `windows-runner-contract.ts`: the standalone
+ * Windows runner's module graph may import node builtins only, so the shared
+ * error type cannot sit in a module that (even type-only) references upstream
+ * packages. Re-exported here unchanged — `instanceof` identity is preserved.
  */
-export declare class DialectUnrecognizedError extends Error {
-    constructor(message: string);
-}
+export { DialectUnrecognizedError };
 /** One wrapped argv split into its runner/profile part and the caller's argv. */
 export interface ConfinedShape {
     /** The recognized dialect. */
@@ -90,3 +94,95 @@ export declare function detectDialect(profileArgs: readonly string[]): RunnerDia
  * @returns the widened profile arguments.
  */
 export declare function widenProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], policy: SandboxPolicy, additionalRoots: readonly string[]): string[];
+/**
+ * Graft writable grants onto a `read-only` profile — the B9 cell where a fixed
+ * `read-write` additional root stays writable while the session mode denies
+ * every other write. Each dialect appends its own grant spelling AFTER
+ * upstream's deny-all baseline, so the appended form wins:
+ *
+ * - seatbelt: SBPL is last-match-wins — a trailing `(allow file-write*
+ *   (subpath …))` overrides the blanket `(deny file-write*)` for those roots;
+ * - bwrap: mounts apply in order — a `--bind W W` after `--ro-bind / /`
+ *   re-mounts that subtree writable inside the read-only namespace;
+ * - landlock: grants union — an extra `--rw W` widens exactly that subtree.
+ *
+ * `windows-acl` cannot be spelled this way and goes through
+ * `widenWindowsProfile` (the standalone runner grants only the listed roots).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream read-only profile arguments.
+ * @param additionalRoots - canonical roots the effective scope keeps writable.
+ * @returns the grafted profile arguments.
+ */
+export declare function graftProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], additionalRoots: readonly string[]): string[];
+/**
+ * Deny `deniedRoots` inside an upstream `workspace-write` profile — the B9 edge
+ * where an explicit `read-only` (or tool-capped) additional root sits under a
+ * directory the profile grants writable (the platform temp area, which an
+ * additional root may legitimately be registered beneath).
+ *
+ * A denied root outside every grant needs no profile work at all: the mode
+ * already denies it. Per dialect:
+ *
+ * - seatbelt appends a trailing `(deny file-write* (subpath …) (literal …))`
+ *   form — last match wins over every earlier allow, and a redundant deny on
+ *   an ungranted root is harmless. The literals pin every ancestor of a denied
+ *   root: Seatbelt checks the operated path only, so `rename`ing an ancestor
+ *   would otherwise move the whole tree out from under its `subpath` deny;
+ * - bwrap re-mounts the root `--ro-bind` AFTER the writable mounts (a later
+ *   mount wins inside the namespace). The source is mandatory: if a denied
+ *   root disappears, namespace setup fails before the command can recreate it.
+ *   This also restores read access to denied roots under a `--tmpfs` target.
+ *   Ancestors of a denied root that lie strictly inside a writable BIND target
+ *   are self-bound (`--bind A A`) BEFORE the ro-binds: the kernel refuses to
+ *   rename a mountpoint, so the deny can no longer be walked off by renaming
+ *   the tree's parent. Ancestors inside a `--tmpfs` target are never bound —
+ *   a rename there only moves namespace-private mounts, while the self-bind
+ *   would expose and make writable the host content the tmpfs hides — and
+ *   ancestors outside every writable target are not renamable anyway;
+ * - landlock cannot subtract: a denied root under an `--rw` grant throws —
+ *   union semantics have no deny primitive;
+ * - windows-acl goes through `widenWindowsProfile`, whose runner-side ACL
+ *   grant cannot subtract either — its caller checks the same overlap. The
+ *   deny ACE does follow its directory object through a parent rename, but
+ *   the moved tree's NEW path no longer matches the recorded deny set — so
+ *   the ambient deny runner pins every ancestor of each deny root with a
+ *   non-delete-sharing handle for the child lifetime (`windows-path-guard.ts`,
+ *   `windows-deny.ts`).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream workspace-write profile arguments.
+ * @param deniedRoots - canonical roots this call must not write.
+ * @returns the profile arguments with the in-profile denies applied.
+ */
+export declare function denyProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], deniedRoots: readonly string[]): string[];
+/**
+ * Restrict an ambient-writable execution to everything EXCEPT `deniedRoots` —
+ * the B9 cell `danger-full-access` + explicit `read-only`. The consumers of
+ * this profile (shell, PTY, PTC) bypass `confine()` entirely under that mode,
+ * so the process fence builds this profile from an upstream skeleton instead:
+ * the caller probes `confine` once under `read-only` to obtain the runner's
+ * argument prefix, and this function rewrites the file-effect part.
+ *
+ * - seatbelt: `(version 1) (allow default)` kept from the profile head, plus a
+ *   trailing `(deny file-write* (subpath …) (literal …))` — allow-default with
+ *   subpath carve-outs, the inverse of the confined profiles. The literals
+ *   pin every ancestor of a denied root, so `rename`ing the tree's parent
+ *   cannot walk it out from under the deny (Seatbelt checks the operated
+ *   path only — verified natively on macOS);
+ * - bwrap: `--ro-bind / /` becomes `--bind / /` (ambient writable namespace),
+ *   each denied root is re-mounted `--ro-bind` after it, and every ancestor
+ *   of a denied root is self-bound `--bind A A` between the root mount and the
+ *   ro-binds — a mountpoint cannot be renamed (EBUSY), so the deny follows no
+ *   rename of the tree's ancestors. A missing source fails the launch,
+ *   retaining the registered negative authorization;
+ * - landlock cannot express "everything except" — its launcher only unions
+ *   allowlists, so it throws. windows-acl expresses the cell through the
+ *   standalone ambient-deny runner instead of this profile rewrite: standing
+ *   deny ACEs on every denied object, plus ancestor pin handles held through
+ *   the child and its drained Job descendants so no rename can vacate the
+ *   registered spelling (`windows-deny.ts`, `windows-path-guard.ts`).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream read-only skeleton's profile arguments.
+ * @param deniedRoots - canonical roots the execution must not write.
+ * @returns the restricted profile arguments.
+ */
+export declare function restrictProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], deniedRoots: readonly string[]): string[];

package/lib/types/fs.d.ts

@@ -65,22 +65,44 @@ export declare class MultiRootFileSystem extends LocalFileSystem {
         version: FsVersion;
     }, signal?: AbortSignal, sandboxPolicy?: SandboxExecutionPolicy): Promise<FsEditOutcome>;
     /**
-     * The writable roots of one workspace-write call: the upstream derivation
-     * (primary root plus the platform temp areas, canonical and deduplicated)
-     * widened by the scope's additional roots, in scope order.
+     * The writable roots of one confined call: the upstream derivation (primary
+     * root plus the platform temp areas, canonical and deduplicated — empty
+     * under `read-only`) widened by the scope's EFFECTIVE writable members.
+     * Under `read-only` that is exactly the fixed `read-write` roots (the tool
+     * cap may already have emptied the scope's list), so an explicit grant
+     * survives a globally read-only session. An unavailable registry authority
+     * never contributes members: a process that cannot read the store grants
+     * only the primary root (and no shared temp grant).
      * @param policy - the per-call policy.
      * @param scope - the scope resolved once for this call; both the fence and
      *   the denial message below share it instead of re-resolving.
-     * @returns the canonical writable roots; empty under `read-only`.
+     * @returns the canonical writable roots; possibly empty.
      */
     private rootsFor;
     /**
-     * Enforce the per-call policy against `target` and return the EXACT target the
-     * mutation must use, so the checked identity is the mutated one (no
-     * check-here-write-there TOCTOU). `read-only` denies; `workspace-write`
-     * re-canonicalizes NOW (reflecting a concurrently swapped symlink ancestor),
-     * requires containment under one of the scope's writable roots, and returns
-     * THAT fresh target; `danger-full-access` returns the caller's target unfenced.
+     * Enforce the per-call policy against `target` and return the EXACT target
+     * the mutation must use, so the checked identity is the mutated one (no
+     * check-here-write-there TOCTOU). Deny precedes containment: a root in
+     * `scope.deniedRoots` — an explicit `read-only` root, or any member when the
+     * call is tool-capped — refuses writes under EVERY mode, including
+     * `danger-full-access` and where a broader grant (the platform temp area)
+     * would otherwise cover the path. `read-only` then grants only the fixed
+     * `read-write` members; `workspace-write` requires containment under the
+     * widened writable set.
+     *
+     * `danger-full-access` is the only mode with a fast path, and only while
+     * the deny set is empty: it then returns the caller's target untouched,
+     * upstream-exact. Once ANY deny boundary exists the caller's `FsTarget` may
+     * be stale — the directory it resolved through can since have been replaced
+     * by a symlink into a denied root — so the fence re-resolves
+     * `target.displayPath`, checks the FRESH target key, and mutates that fresh
+     * target rather than the stale one the caller resolved earlier.
+     *
+     * One more Full-access rule: while the registry authority is `unavailable`
+     * the empty deny set is not trustworthy — the store this process cannot
+     * read may hold explicit `read-only` registrations — so the mode degrades
+     * to primary-root-only writes (no shared temp or additional-root grants)
+     * until the authority returns.
      * @param target - the resolved target about to be mutated.
      * @param sandboxPolicy - the per-call policy; omit for the deployment fallback.
      * @returns the fresh canonical target the mutation must use.

package/lib/types/index.d.ts

@@ -25,12 +25,16 @@ export { classifyInstallation, compatEnforcement, CORE_PACKAGES, OPTIONAL_CORE_P
 export type { CompatEnforcement, CompatReport, CompatVerdict, InspectedPackage, SupportedDshRelease, VersionReader, } from './compat/dsh-version.ts';
 export { instructionsApi, renderInstructions } from './compat/agent-instructions.ts';
 export type { InstructionsApi, RenderedInstructions } from './compat/agent-instructions.ts';
+export { AGENT_PTY_MARKER, agentPtyMarkerVerdict, assertAgentPtyMarker, PtyMarkerContractError } from './compat/pty-marker.ts';
+export type { AgentPtyMarkerIo, AgentPtyMarkerVerdict } from './compat/pty-marker.ts';
 export { createInstructionMessage } from './compat/llm-message.ts';
 export type { InstructionMessageInput } from './compat/llm-message.ts';
 export { widenConfined } from './compat/sandbox-confine.ts';
 export type { ConfineCall, UpstreamConfined } from './compat/sandbox-confine.ts';
 export { composeInstructionMessage, DEFAULT_MAX_BYTES, PLUGIN_SOURCE } from './instructions.ts';
 export type { Config as InstructionsConfig } from './instructions.ts';
+export { MultiRootProviders, brandMultiRootProvider, isMultiRootProvider, MULTI_ROOT_PROVIDER_BRAND } from './providers.ts';
+export type { ProviderKind } from './providers.ts';
 export { MultiRootFileSystem } from './fs.ts';
 export type { Config as FileSystemConfig } from './fs.ts';
 export { MultiRootSandboxProvider } from './sandbox.ts';
@@ -38,6 +42,7 @@ export type { Config as SandboxConfig } from './sandbox.ts';
 export { MultiRootScopeService, sanitizeAdditionalRoots, renderWorkspaceRootsContext } from './scope.ts';
 export type { AdditionalWorkspaceRoot, FilesystemScope } from './scope.ts';
 export { MultiRootRegistry, DOMAIN_NAME, MAX_ALIAS_LENGTH, REGISTRY_CONTENDED_MESSAGE, multiRootDomainSpec } from './registry.ts';
+export { DEFAULT_MAX_ADDITIONAL_ROOTS, MAX_ADDITIONAL_ROOTS_CEILING } from './registry.ts';
 export type { AddRootInput, Config as RegistryConfig, PersistedPrimaryRoot, RegistryAuthorityState } from './registry.ts';
 export { RegistryAuthorityLease, RegistryLeaseContendedError } from './registry-lease.ts';
 export { availableRoots, canonicalRoot, classifyStoredRoots, expandRootInput, indexedStatuses, isCanonicallyUnder, additionalRootId, removeStatusAt, resolveRootRef, RootValidationError, validateRootCandidate, } from './roots.ts';

package/lib/types/lsp.d.ts

@@ -0,0 +1,4 @@
+/** Add root routing at the public LSP query seam; upstream owns servers and disposal. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;

package/lib/types/method-wrapper.d.ts

@@ -0,0 +1,2 @@
+/** Wrap a public method on a Cordis service without capturing a caller-context proxy. */
+export declare function wrapMethod<T extends object, K extends keyof T>(target: T, key: K, wrap: (original: T[K]) => T[K]): () => void;

package/lib/types/process-fence.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
+ * never sees — `danger-full-access` with explicit `read-only` additional roots.
+ *
+ * Upstream, every confined consumer routes through `ctx.sandbox.confine`, which
+ * this bundle's provider already widens (grants, the read-only fixed-write
+ * graft, and the workspace-write deny edge). But the shell executor, the PTC
+ * runtime and the PTY backend all short-circuit that mode: `policy.mode ===
+ * 'danger-full-access'` returns the bare argv, so an explicit `read-only` root
+ * would silently stay writable. This row closes the gap without touching any
+ * upstream executor:
+ *
+ * - `ctx.subprocess.spawn` is wrapped to prepend a precomputed restricted
+ *   profile whenever the AsyncLocalStorage below carries one. `spawn` is
+ *   synchronous, so the profile — which never depends on the callee's argv —
+ *   is built by the wrapping consumer, not here.
+ * - `ctx.shell.execute` (bash and pwsh alike, and `start` where an older
+ *   release still exposes it — `compat/process-entrypoints.ts` owns which
+ *   entries a mounted executor actually carries) resolves the per-call policy
+ *   exactly the way the executor itself does, and — under Full-access with
+ *   deny roots — asks the sandbox provider for the restricted prefix and runs
+ *   the call inside the store, so every subprocess the executor launches is
+ *   confined.
+ * - `ctx.ptcRuntime.run` does the same for `run_code`.
+ * - `ctx.subprocess.spawnTerminal` keys on the `DSH_PTY_SESSION_ID` marker:
+ *   every supported `dsh-terminal-bash` backend stamps it (alongside
+ *   `DSH_SESSION_ID`) when it launches an agent's PTY, and no other caller —
+ *   above all the panel's terminal controller — ever sets it. A spec without
+ *   the marker is a USER terminal, passed through untouched in every mode:
+ *   the sandbox protects agent behavior, and upstream never confines the
+ *   user's own terminal. Because that marker is the ONLY discriminator, the
+ *   `multi-root-compat` gate asserts it at boot (`compat/pty-marker.ts`):
+ *   an installed backend whose emitted code no longer stamps it fails the
+ *   plugin load rather than silently reclassifying agent PTYs as the user's.
+ *   `ctx.terminals` itself is deliberately NOT wrapped:
+ *   upstream mounts it inside `optional-persistent-terminals` with
+ *   `isolate: { terminals: true }`, so the registry entry is unreachable from
+ *   this row — the shared `spawnTerminal` seam plus the env discriminator
+ *   covers both the un-isolated SDK mount and the isolated web mount.
+ *
+ * The same seam carries the unknown-authority downgrade: while the scope
+ * reports `authority: 'unavailable'` — a contended, storage-failed or
+ * config-invalid registry publishes an empty deny set that is NOT evidence —
+ * `danger-full-access` executions run inside a primary-root-only
+ * profile (with the deny set applied) instead of ambient.
+ *
+ * Windows uses the standalone ambient deny-token runner. Landlock cannot subtract a subtree, so that combination selects bubblewrap.
+ * An unusable mount runner fails without starting an unconfined process.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/process-fence
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;