@dsh-electron/dsh-plugin-multi-root-workspace 0.1.5 → 0.1.7

package/lib/command.js

@@ -1,2 +1,2 @@
-import { a as renderRootsReport, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealArgv, t as COMMAND_NAME } from "./command-DyOWujPo.js";
-export { COMMAND_NAME, apply, inject, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealArgv };
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, n as apply, o as resolvePanelPrimaryRoot, r as inject, s as revealAccepted, t as COMMAND_NAME } from "./command-CESuwlVt.js";
+export { COMMAND_NAME, apply, inject, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealAccepted, revealArgv };

package/lib/{compat-82Y27Iom.js → compat-DF_yL1bB.js}

@@ -1,5 +1,7 @@
 import { createRequire } from "node:module";
 import { Service } from "@deepseek-ai/cordis";
+import { readFileSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
 //#region src/compat/dsh-version.ts
 /**
 * The DSH compatibility contract: which upstream releases this plugin is
@@ -40,7 +42,14 @@ const SUPPORTED_DSH_RELEASES = [
 	"0.1.7-rc.1",
 	"0.1.7-rc.2",
 	"0.2.0-rc.1",
-	"0.2.0-rc.2"
+	"0.2.0-rc.2",
+	"0.2.1-alpha.1",
+	"0.2.1-alpha.2",
+	"0.2.1-alpha.3",
+	"0.2.1-alpha.4",
+	"0.2.1-alpha.5",
+	"0.2.1-rc.1",
+	"0.2.1-rc.2"
 ];
 /**
 * Packages whose absence means this plugin cannot function at all: every one of
@@ -61,6 +70,13 @@ const REQUIRED_CORE_PACKAGES = [
 * that is the mixed-installation failure this contract exists to catch.
 */
 const OPTIONAL_CORE_PACKAGES = [
+	"@deepseek-ai/dsh-tools",
+	"@deepseek-ai/dsh-working-directory",
+	"@deepseek-ai/dsh-lsp",
+	"@deepseek-ai/dsh-lsp-stdio",
+	"@deepseek-ai/dsh-api-workspace-files",
+	"@deepseek-ai/dsh-typert-protocol",
+	"@deepseek-ai/dsh-sandbox-windows-acl",
 	"@deepseek-ai/dsh-agent",
 	"@deepseek-ai/dsh-agent-instructions",
 	"@deepseek-ai/dsh-client-connection",
@@ -72,6 +88,8 @@ const OPTIONAL_CORE_PACKAGES = [
 ];
 /** Every package the contract inspects, required first. */
 const CORE_PACKAGES = [...REQUIRED_CORE_PACKAGES, ...OPTIONAL_CORE_PACKAGES];
+/** Services looked up structurally; older runtimes never install these modules. */
+const HOST_RESOLVED_PACKAGES = ["@deepseek-ai/dsh-working-directory"];
 /** The environment variable that relaxes the gate. */
 const COMPAT_ENFORCEMENT_ENV = "DSH_MULTI_ROOT_COMPAT";
 /**
@@ -88,11 +106,18 @@ const COMPAT_ENFORCEMENT_ENV = "DSH_MULTI_ROOT_COMPAT";
 *   manifest cannot be resolved.
 */
 function readInstalledVersion(packageName) {
+	const require = createRequire(import.meta.url);
 	try {
-		const manifest = createRequire(import.meta.url)(`${packageName}/package.json`);
+		const manifest = require(`${packageName}/package.json`);
 		return typeof manifest.version === "string" ? manifest.version : void 0;
 	} catch {
-		return;
+		if (!HOST_RESOLVED_PACKAGES.includes(packageName)) return void 0;
+		try {
+			const manifest = createRequire(require.resolve("@deepseek-ai/dsh/package.json"))(`${packageName}/package.json`);
+			return typeof manifest.version === "string" ? manifest.version : void 0;
+		} catch {
+			return;
+		}
 	}
 }
 /**
@@ -174,6 +199,156 @@ function report(verdict, release, packages, lines) {
 	};
 }
 //#endregion
+//#region src/compat/pty-marker.ts
+/**
+* Boot-time probe for the agent-PTY marker contract.
+*
+* `multi-root-process-fence` tells an agent terminal from the user's own by
+* one env fact: every supported `dsh-terminal-bash` backend stamps
+* `DSH_PTY_SESSION_ID` (alongside `DSH_SESSION_ID`) into the PTY spawn spec,
+* while the panel's terminal controller stamps only `DSH_SESSION_ID`. That
+* marker is the ONLY discriminator — a backend that ever stops stamping it
+* would reclassify agent PTYs as user terminals and pass them through
+* unconfined under a restricted `danger-full-access`, which is a silent
+* fail-open on a security boundary.
+*
+* The marker is an env key inside upstream's emitted code, not an exported
+* symbol, so the honest structural probe is content: the installed backend
+* package must still write the marker. This module is called from the
+* `multi-root-compat` gate (`src/compat.ts`) BEFORE the service registers —
+* like the version verdict it is a precondition, not a diagnostic, and a
+* breach refuses the composition the same way `mixed`/`incomplete` do: it is
+* not relaxable by `DSH_MULTI_ROOT_COMPAT=warn`.
+*
+* Resolution follows the optional-peer precedent (`agent-instructions.ts`):
+* the backend is not a peer of this plugin, so the plugin anchor is tried
+* first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
+* same `HOST_RESOLVED_PACKAGES` pattern as `dsh-version.ts` — because the
+* backend rides inside the harness meta package's own dependency tree.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
+*/
+/** The env key that identifies an agent-launched PTY spawn spec. */
+const AGENT_PTY_MARKER = "DSH_PTY_SESSION_ID";
+/** The upstream package whose backend owns the marker stamp. */
+const TERMINAL_BACKEND = "@deepseek-ai/dsh-terminal-bash";
+/** The harness meta package the backend rides inside (its dependency). */
+const HOST_ANCHOR = "@deepseek-ai/dsh/package.json";
+/** Scan budget: enough for any plausible backend layout, bounded forever. */
+const MAX_SOURCE_FILES = 256;
+const MAX_TOTAL_BYTES = 8388608;
+/**
+* Raised when the installed terminal backend does not uphold the marker
+* contract. Thrown from `apply` like `DshCompatUnsupportedError`, so it
+* surfaces as a plugin load failure with the diagnosis attached.
+*/
+var PtyMarkerContractError = class extends Error {
+	/** The resolved backend path when one was found. */
+	backend;
+	constructor(message, backend) {
+		super(message);
+		this.name = "PtyMarkerContractError";
+		this.backend = backend;
+	}
+};
+/**
+* Resolve the backend package root through the two anchors the contract can
+* reach: this module first (flat layouts where the backend is a direct
+* install), then the `@deepseek-ai/dsh` host manifest (pnpm-style layouts
+* where it is the meta package's own dependency — the
+* `HOST_RESOLVED_PACKAGES` precedent). A resolution failure that is not a
+* genuine NOT_FOUND propagates: a resolvable-but-broken specifier is not
+* evidence of absence.
+*/
+function resolveBackendRoot() {
+	const self = createRequire(import.meta.url);
+	const anchors = [self];
+	try {
+		anchors.push(createRequire(self.resolve(HOST_ANCHOR)));
+	} catch (error) {
+		if (!isNotFound(error)) throw error;
+	}
+	for (const anchor of anchors) try {
+		return dirname(anchor.resolve(`${TERMINAL_BACKEND}/package.json`));
+	} catch (error) {
+		if (!isNotFound(error)) throw error;
+	}
+}
+function isNotFound(error) {
+	const code = error?.code;
+	return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
+}
+/** Recursively collect `.js` sources under the package root, within budget. */
+function listSources(root) {
+	const files = [];
+	const visit = (dir) => {
+		for (const entry of readdirSync(dir, { withFileTypes: true })) {
+			if (files.length >= MAX_SOURCE_FILES) return;
+			const path = join(dir, entry.name);
+			if (entry.isDirectory() && entry.name !== "node_modules") visit(path);
+			else if (entry.isFile() && entry.name.endsWith(".js")) files.push(path);
+		}
+	};
+	visit(root);
+	return files;
+}
+const defaultIo = {
+	resolveBackendRoot,
+	listSources,
+	read: (path) => readFileSync(path, "utf8")
+};
+/**
+* Judge the installed terminal backend against the marker contract.
+*
+* Never throws: every outcome — absent package, unreadable source, missing
+* marker — is folded into the verdict so the caller's reaction is a policy
+* decision in one place.
+* @param io - filesystem seams; tests inject them, production uses real fs.
+* @returns the verdict.
+*/
+function agentPtyMarkerVerdict(io = defaultIo) {
+	let root;
+	try {
+		root = io.resolveBackendRoot();
+	} catch {
+		return "unverifiable";
+	}
+	if (root === void 0) return "uninstalled";
+	let files;
+	try {
+		files = io.listSources(root);
+	} catch {
+		return "unverifiable";
+	}
+	let remaining = MAX_TOTAL_BYTES;
+	for (const file of files) {
+		let content;
+		try {
+			content = io.read(file);
+		} catch {
+			return "unverifiable";
+		}
+		if (content.length > remaining) return "unverifiable";
+		if (content.includes("DSH_PTY_SESSION_ID")) return "stamped";
+		remaining -= content.length;
+	}
+	return "unverifiable";
+}
+/**
+* Enforce the contract: refuse when the marker cannot be confirmed.
+*
+* @param io - filesystem seams; tests inject them.
+* @throws {PtyMarkerContractError} on `unverifiable`.
+*/
+function assertAgentPtyMarker(io = defaultIo) {
+	if (agentPtyMarkerVerdict(io) !== "unverifiable") return;
+	let backend;
+	try {
+		backend = io.resolveBackendRoot();
+	} catch {}
+	throw new PtyMarkerContractError(`multi-root workspace: the installed ${TERMINAL_BACKEND} does not stamp ${AGENT_PTY_MARKER} on agent PTY spawns, or its sources cannot be verified. That marker is the only fact that separates an agent terminal from the user's own — without it the process fence cannot confine a restricted danger-full-access agent PTY without confining the user's terminal too. The plugin refuses to run rather than let agent terminals pass unconfined. See docs/decisions/ADR-0017-three-state-root-access-and-sandbox-modes.md.`, backend);
+}
+//#endregion
 //#region src/compat.ts
 /**
 * `multi-root-compat`: the startup gate that turns the DSH compatibility
@@ -271,7 +446,8 @@ function apply(ctx) {
 	const report = classifyInstallation();
 	const warning = assertSupportedInstallation(report, compatEnforcement());
 	if (warning !== void 0) ctx.logger.warn(warning);
+	assertAgentPtyMarker();
 	ctx.plugin(MultiRootCompatService, report);
 }
 //#endregion
-export { inject as a, REQUIRED_CORE_PACKAGES as c, compatEnforcement as d, readInstalledVersion as f, assertSupportedInstallation as i, SUPPORTED_DSH_RELEASES as l, MultiRootCompatService as n, CORE_PACKAGES as o, apply as r, OPTIONAL_CORE_PACKAGES as s, DshCompatUnsupportedError as t, classifyInstallation as u };
+export { inject as a, agentPtyMarkerVerdict as c, OPTIONAL_CORE_PACKAGES as d, REQUIRED_CORE_PACKAGES as f, readInstalledVersion as g, compatEnforcement as h, assertSupportedInstallation as i, assertAgentPtyMarker as l, classifyInstallation as m, MultiRootCompatService as n, AGENT_PTY_MARKER as o, SUPPORTED_DSH_RELEASES as p, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t, CORE_PACKAGES as u };

package/lib/compat.js

@@ -1,2 +1,2 @@
-import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-82Y27Iom.js";
+import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-DF_yL1bB.js";
 export { DshCompatUnsupportedError, MultiRootCompatService, apply, assertSupportedInstallation, inject };

package/lib/contract-DZ4zczDT.js

@@ -0,0 +1,238 @@
+import { z } from "zod";
+//#region src/contract.ts
+/**
+* The wire contract between the browser panel and this plugin's host half.
+*
+* It is deliberately transport-agnostic plain data: the host registers one
+* Connection RPC channel (see `command.ts`) and the client bundle inlines this
+* module, so both sides agree on endpoint names and payload shapes without
+* sharing any runtime identity. Error codes are the stable half of the
+* contract; `message` is only a fallback the panel does not have to show.
+*
+* Two properties this module owns:
+*
+* - **One shape per endpoint.** {@link PanelResponseMap} is the single mapping
+*   from endpoint to response type, so the panel cannot silently decode one
+*   endpoint's answer as another's. `reveal` answers with
+*   {@link RevealedView}; root-management endpoints answer with
+*   {@link RootsView}.
+*   The host builds those answers in `command.ts` and the
+*   panel parses them here — one definition, two consumers.
+* - **Runtime validation at the boundary.** The payload arrives from a browser
+*   and the answer arrives from the host; neither is trusted to match the
+*   TypeScript types. {@link parsePanelCall} and the `parse*View` functions
+*   check the shapes and report structural failures as a message, so a
+*   mismatch becomes a visible, localized error instead of a crash or a
+*   silently wrong render.
+*
+* Nothing here may import `node:*` or `@deepseek-ai/*`: this module is inlined
+* into the browser bundle.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/contract
+*/
+/** The absolute logical channel both halves speak over. */
+const PANEL_CHANNEL = "/multi-root-workspace";
+/** Every endpoint name, for exhaustive iteration in tests and callers. */
+const PANEL_ENDPOINTS = [
+	"list",
+	"add",
+	"remove",
+	"alias",
+	"move",
+	"setAccess",
+	"reveal"
+];
+/** The shared nine-cell rule; tool dispatch may subsequently narrow writes. */
+function effectiveRootAccess(access, mode) {
+	if (access !== "inherit") return access;
+	return mode === "danger-full-access" ? "full-access" : mode === "workspace-write" ? "read-write" : "read-only";
+}
+/**
+* The request body on the wire. The endpoint travels as the RPC method, not as
+* a field, so this schema covers the fields only; the host pairs it with the
+* method the channel dispatched (and rejects the pair if the body contradicts
+* it). Unknown keys are rejected rather than ignored: a client sending a field
+* this host does not understand is out of contract, and silently dropping it
+* would hide the drift.
+*/
+const panelRequestSchema = z.object({
+	sessionId: z.string().min(1),
+	entry: z.object({
+		ordinal: z.number().int().positive(),
+		id: z.string(),
+		path: z.string(),
+		addedAt: z.string()
+	}).strict().optional(),
+	id: z.string().optional(),
+	path: z.string().optional(),
+	alias: z.string().optional(),
+	access: z.enum([
+		"inherit",
+		"read-write",
+		"read-only"
+	]).optional(),
+	beforeEntry: z.object({
+		ordinal: z.number().int().positive(),
+		id: z.string(),
+		path: z.string(),
+		addedAt: z.string()
+	}).strict().optional(),
+	beforeId: z.string().optional()
+}).strict();
+/**
+* One root as it travels over the channel. Deliberately NOT strict, in both
+* directions: a newer host that adds a field must not brick an older panel, and
+* the field that matters is the state it reports.
+*/
+const rootViewSchema = z.object({
+	ordinal: z.number().int().positive(),
+	id: z.string(),
+	path: z.string(),
+	alias: z.string().optional(),
+	addedAt: z.string(),
+	state: z.enum([
+		"available",
+		"missing",
+		"redirected",
+		"invalid"
+	]),
+	access: z.enum([
+		"inherit",
+		"read-write",
+		"read-only"
+	]).optional(),
+	detail: z.string().optional(),
+	effectiveAccess: z.enum([
+		"read-only",
+		"read-write",
+		"full-access",
+		"unavailable"
+	]).optional()
+});
+const rootsViewSchema = z.object({
+	primaryRoot: z.string(),
+	primaryName: z.string().optional(),
+	effectiveCwd: z.string().optional(),
+	mode: z.enum([
+		"read-only",
+		"workspace-write",
+		"danger-full-access"
+	]).optional(),
+	cappedTools: z.array(z.string()).optional(),
+	toolAccessInvalid: z.boolean().optional(),
+	roots: z.array(rootViewSchema),
+	limit: z.number().int().nonnegative().optional(),
+	count: z.number().int().nonnegative().optional(),
+	unavailable: z.string().optional()
+});
+const revealedViewSchema = z.object({ revealed: z.string() });
+z.object({
+	code: z.string(),
+	message: z.string(),
+	details: z.unknown().optional()
+});
+/**
+* Validate the payload the host received for one endpoint.
+* @param endpoint - the endpoint the channel dispatched (the RPC method).
+* @param payload - the raw channel payload (the request body).
+* @returns the call the host may act on, or the reason it is not one.
+*/
+function parsePanelCall(endpoint, payload) {
+	if (!PANEL_ENDPOINTS.includes(endpoint)) return {
+		ok: false,
+		message: `unknown endpoint "${endpoint}"`
+	};
+	const parsed = panelRequestSchema.safeParse(payload ?? {});
+	if (!parsed.success) return {
+		ok: false,
+		message: `the request body is invalid: ${firstIssue(parsed.error)}`
+	};
+	return {
+		ok: true,
+		value: narrowCall(endpoint, parsed.data)
+	};
+}
+/**
+* Validate a `RootsView` when it arrives.
+* @param value - the raw endpoint value.
+* @returns the view, or the reason it is not one.
+*/
+function parseRootsView(value) {
+	const parsed = rootsViewSchema.safeParse(value);
+	if (!parsed.success) return {
+		ok: false,
+		message: `the answer is not a roots view: ${firstIssue(parsed.error)}`
+	};
+	const view = parsed.data;
+	return {
+		ok: true,
+		value: {
+			primaryRoot: view.primaryRoot,
+			...view.primaryName === void 0 ? {} : { primaryName: view.primaryName },
+			...view.effectiveCwd === void 0 ? {} : { effectiveCwd: view.effectiveCwd },
+			...view.mode === void 0 ? {} : { mode: view.mode },
+			...view.cappedTools === void 0 ? {} : { cappedTools: view.cappedTools },
+			...view.toolAccessInvalid === void 0 ? {} : { toolAccessInvalid: view.toolAccessInvalid },
+			roots: view.roots.map(narrowRootView),
+			limit: view.limit ?? Number.MAX_SAFE_INTEGER,
+			count: view.count ?? view.roots.length,
+			...view.unavailable === void 0 ? {} : { unavailable: view.unavailable }
+		}
+	};
+}
+/**
+* Validate a `RevealedView` when it arrives.
+* @param value - the raw endpoint value.
+* @returns the view, or the reason it is not one.
+*/
+function parseRevealedView(value) {
+	const parsed = revealedViewSchema.safeParse(value);
+	if (!parsed.success) return {
+		ok: false,
+		message: `the answer is not a reveal result: ${firstIssue(parsed.error)}`
+	};
+	return {
+		ok: true,
+		value: parsed.data
+	};
+}
+/**
+* Rebuild a parsed call as the declared type, keeping absent optional fields
+* ABSENT (`exactOptionalPropertyTypes` distinguishes "absent" from "undefined",
+* and the host's own code reads the two the same way the panel sent them).
+*/
+function narrowCall(endpoint, value) {
+	return {
+		endpoint,
+		sessionId: value.sessionId,
+		...value.entry === void 0 ? {} : { entry: value.entry },
+		...value.id === void 0 ? {} : { id: value.id },
+		...value.path === void 0 ? {} : { path: value.path },
+		...value.alias === void 0 ? {} : { alias: value.alias },
+		...value.access === void 0 ? {} : { access: value.access },
+		...value.beforeEntry === void 0 ? {} : { beforeEntry: value.beforeEntry },
+		...value.beforeId === void 0 ? {} : { beforeId: value.beforeId }
+	};
+}
+/** Rebuild one parsed root as the declared `RootView`. */
+function narrowRootView(value) {
+	return {
+		ordinal: value.ordinal,
+		id: value.id,
+		path: value.path,
+		addedAt: value.addedAt,
+		state: value.state,
+		access: value.access ?? "inherit",
+		...value.effectiveAccess === void 0 ? {} : { effectiveAccess: value.effectiveAccess },
+		...value.alias === void 0 ? {} : { alias: value.alias },
+		...value.detail === void 0 ? {} : { detail: value.detail }
+	};
+}
+/** Render the first zod issue as one short sentence. */
+function firstIssue(error) {
+	const issue = error.issues[0];
+	if (issue === void 0) return "invalid";
+	return `${issue.path.length === 0 ? "" : `${issue.path.join(".")}: `}${issue.message}`;
+}
+//#endregion
+export { parseRevealedView as a, parsePanelCall as i, PANEL_ENDPOINTS as n, parseRootsView as o, effectiveRootAccess as r, PANEL_CHANNEL as t };

package/lib/{fs-D_Sw3o5z.js → fs-9JIzGaf3.js}

@@ -1,3 +1,4 @@
+import { brandMultiRootProvider } from "./providers.js";
 import { dirname, sep } from "node:path";
 import { writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { FsError } from "@deepseek-ai/dsh-fs";
@@ -72,6 +73,7 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 	defaultMode;
 	constructor(ctx, config) {
 		super(ctx, config);
+		brandMultiRootProvider(this, "fs");
 		this.defaultMode = ctx.sandboxPolicy.defaultMode;
 	}
 	/** The deployment default mode — the capability fact the tool layer reads to advertise escalation. */
@@ -107,47 +109,81 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
 	}
 	/**
-	* The writable roots of one workspace-write call: the upstream derivation
-	* (primary root plus the platform temp areas, canonical and deduplicated)
-	* widened by the scope's additional roots, in scope order.
+	* The writable roots of one confined call: the upstream derivation (primary
+	* root plus the platform temp areas, canonical and deduplicated — empty
+	* under `read-only`) widened by the scope's EFFECTIVE writable members.
+	* Under `read-only` that is exactly the fixed `read-write` roots (the tool
+	* cap may already have emptied the scope's list), so an explicit grant
+	* survives a globally read-only session. An unavailable registry authority
+	* never contributes members: a process that cannot read the store grants
+	* only the primary root (and no shared temp grant).
 	* @param policy - the per-call policy.
 	* @param scope - the scope resolved once for this call; both the fence and
 	*   the denial message below share it instead of re-resolving.
-	* @returns the canonical writable roots; empty under `read-only`.
+	* @returns the canonical writable roots; possibly empty.
 	*/
 	rootsFor(policy, scope) {
+		if (scope.authority === "unavailable") return policy.mode === "read-only" ? [] : [scope.primaryRoot];
 		const roots = writableRoots(policy);
-		if (roots.length === 0) return roots;
-		for (const root of scope.additionalRoots) if (!roots.includes(root)) roots.push(root);
+		for (const root of scope.writableRoots) if (!roots.includes(root)) roots.push(root);
 		return roots;
 	}
 	/**
-	* Enforce the per-call policy against `target` and return the EXACT target the
-	* mutation must use, so the checked identity is the mutated one (no
-	* check-here-write-there TOCTOU). `read-only` denies; `workspace-write`
-	* re-canonicalizes NOW (reflecting a concurrently swapped symlink ancestor),
-	* requires containment under one of the scope's writable roots, and returns
-	* THAT fresh target; `danger-full-access` returns the caller's target unfenced.
+	* Enforce the per-call policy against `target` and return the EXACT target
+	* the mutation must use, so the checked identity is the mutated one (no
+	* check-here-write-there TOCTOU). Deny precedes containment: a root in
+	* `scope.deniedRoots` — an explicit `read-only` root, or any member when the
+	* call is tool-capped — refuses writes under EVERY mode, including
+	* `danger-full-access` and where a broader grant (the platform temp area)
+	* would otherwise cover the path. `read-only` then grants only the fixed
+	* `read-write` members; `workspace-write` requires containment under the
+	* widened writable set.
+	*
+	* `danger-full-access` is the only mode with a fast path, and only while
+	* the deny set is empty: it then returns the caller's target untouched,
+	* upstream-exact. Once ANY deny boundary exists the caller's `FsTarget` may
+	* be stale — the directory it resolved through can since have been replaced
+	* by a symlink into a denied root — so the fence re-resolves
+	* `target.displayPath`, checks the FRESH target key, and mutates that fresh
+	* target rather than the stale one the caller resolved earlier.
+	*
+	* One more Full-access rule: while the registry authority is `unavailable`
+	* the empty deny set is not trustworthy — the store this process cannot
+	* read may hold explicit `read-only` registrations — so the mode degrades
+	* to primary-root-only writes (no shared temp or additional-root grants)
+	* until the authority returns.
 	* @param target - the resolved target about to be mutated.
 	* @param sandboxPolicy - the per-call policy; omit for the deployment fallback.
 	* @returns the fresh canonical target the mutation must use.
 	*/
 	async checkedTarget(target, sandboxPolicy) {
 		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
-		const { mode } = policy;
-		if (mode === "danger-full-access") return target;
-		if (mode === "read-only") throw new FsError(`cannot write "${target.displayPath}": file access denied under read-only mode`, "FS_SANDBOX_DENIED");
-		const fresh = await this.resolve(target.displayPath);
 		const scope = this.ctx.multiRootScope.resolve(policy);
-		const roots = this.rootsFor(policy, scope);
+		const effectiveMode = scope.authority === "unavailable" && policy.mode === "danger-full-access" ? "workspace-write" : policy.mode;
+		if (effectiveMode === "danger-full-access" && scope.deniedRoots.length === 0) return target;
+		const fresh = await this.resolve(target.displayPath);
+		if (scope.deniedRoots.length > 0) {
+			for (const path of scope.deniedRoots) if (await isPathUnder(fresh.targetKey, path)) {
+				const root = scope.roots.find((root) => root.path === path);
+				const reason = path === scope.protectedHome ? `${path} is the DSH home directory, which is protected under danger-full-access while workspace restrictions apply` : root?.access === "read-only" || root === void 0 ? `${path} is a read-only additional root` : `${path} is an additional root this call may not write`;
+				throw new FsError(`cannot write "${target.displayPath}": ${reason}`, "FS_SANDBOX_DENIED");
+			}
+		}
+		if (effectiveMode === "danger-full-access") return fresh;
+		const effectivePolicy = {
+			...policy,
+			mode: effectiveMode
+		};
+		const roots = this.rootsFor(effectivePolicy, scope);
 		let contained = false;
 		for (const root of roots) if (await isPathUnder(fresh.targetKey, root)) {
 			contained = true;
 			break;
 		}
 		if (!contained) {
-			const denial = `cannot write "${target.displayPath}": file access denied under workspace-write mode`;
-			throw new FsError(scope.additionalRoots.length === 0 ? denial : `${denial}; allowed roots: ${roots.join(", ")}`, "FS_SANDBOX_DENIED");
+			let denial = `cannot write "${target.displayPath}": file access denied under ${effectiveMode} mode`;
+			if (scope.additionalRoots.length > 0) denial += `; allowed roots: ${roots.join(", ")}`;
+			throw new FsError(denial, "FS_SANDBOX_DENIED");
 		}
 		return fresh;
 	}

package/lib/fs.js

@@ -1,2 +1,3 @@
-import { t as MultiRootFileSystem } from "./fs-D_Sw3o5z.js";
+import "./providers.js";
+import { t as MultiRootFileSystem } from "./fs-9JIzGaf3.js";
 export { MultiRootFileSystem, MultiRootFileSystem as default };

package/lib/index.js

@@ -1,11 +1,13 @@
-import { c as REQUIRED_CORE_PACKAGES, d as compatEnforcement, f as readInstalledVersion, i as assertSupportedInstallation, l as SUPPORTED_DSH_RELEASES, n as MultiRootCompatService, o as CORE_PACKAGES, s as OPTIONAL_CORE_PACKAGES, t as DshCompatUnsupportedError, u as classifyInstallation } from "./compat-82Y27Iom.js";
-import { a as composeInstructionMessage, c as createInstructionMessage, l as instructionsApi, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES, u as renderInstructions } from "./instructions-Cn1Jj5Xi.js";
-import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-D8Fw95FM.js";
-import { a as classifyStoredRoots, c as indexedStatuses, f as resolveRootRef, i as canonicalRoot, l as isCanonicallyUnder, n as additionalRootId, p as validateRootCandidate, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-DasWEBJk.js";
-import { t as MultiRootFileSystem } from "./fs-D_Sw3o5z.js";
+import { c as agentPtyMarkerVerdict, d as OPTIONAL_CORE_PACKAGES, f as REQUIRED_CORE_PACKAGES, g as readInstalledVersion, h as compatEnforcement, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as classifyInstallation, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as SUPPORTED_DSH_RELEASES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES } from "./compat-DF_yL1bB.js";
+import { a as composeInstructionMessage, c as createInstructionMessage, l as instructionsApi, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES, u as renderInstructions } from "./instructions-D19jRxN0.js";
+import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-Kup4_ZIb.js";
+import { a as classifyStoredRoots, c as indexedStatuses, i as canonicalRoot, l as isCanonicallyUnder, m as validateRootCandidate, n as additionalRootId, p as resolveRootRef, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-B-0l8mNG.js";
+import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
+import { t as MultiRootFileSystem } from "./fs-9JIzGaf3.js";
+import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-DZ4zczDT.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
-import { c as RegistryLeaseContendedError, i as REGISTRY_CONTENDED_MESSAGE, n as MAX_ALIAS_LENGTH, o as multiRootDomainSpec, r as MultiRootRegistry, s as RegistryAuthorityLease, t as DOMAIN_NAME } from "./registry-DySMbjgW.js";
-import { a as renderRootsReport, c as PANEL_CHANNEL, d as parseRevealedView, f as parseRootsView, i as parseFoldersCommand, l as PANEL_ENDPOINTS, o as resolvePanelPrimaryRoot, s as revealArgv, t as COMMAND_NAME, u as parsePanelCall } from "./command-DyOWujPo.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-DCxC5Lay.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-CESuwlVt.js";
 //#region src/index.ts
 /**
 * Carrier plugin face for the bare-package-name loader row (see the module
@@ -16,4 +18,4 @@ import { a as renderRootsReport, c as PANEL_CHANNEL, d as parseRevealedView, f a
 const inject = [];
 function apply() {}
 //#endregion
-export { COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, MAX_ALIAS_LENGTH, MultiRootCompatService, MultiRootFileSystem, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, apply, assertSupportedInstallation, availableRoots, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, multiRootDomainSpec, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };
+export { AGENT_PTY_MARKER, COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_ADDITIONAL_ROOTS, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MULTI_ROOT_PROVIDER_BRAND, MultiRootCompatService, MultiRootFileSystem, MultiRootProviders, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, PtyMarkerContractError, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, agentPtyMarkerVerdict, apply, assertAgentPtyMarker, assertSupportedInstallation, availableRoots, brandMultiRootProvider, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, isMultiRootProvider, multiRootDomainSpec, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };