@dsh-electron/dsh-plugin-multi-root-workspace 0.1.5 → 0.1.7

package/lib/{instructions-Cn1Jj5Xi.js → instructions-D19jRxN0.js}

@@ -1,8 +1,11 @@
-import { l as isCanonicallyUnder } from "./roots-DasWEBJk.js";
+import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
+import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
 import { createRequire } from "node:module";
 import "@deepseek-ai/cordis";
-import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 //#region src/compat/agent-instructions.ts
 /**
@@ -221,6 +224,51 @@ function toolResultFailed(message) {
 	return block.isError === true;
 }
 //#endregion
+//#region src/compat/instruction-overlap.ts
+/** Recognize files already represented by the native instruction baseline in this step. */
+function nativeInstructionCopies(messages, cwd) {
+	const represented = /* @__PURE__ */ new Map();
+	const removed = /* @__PURE__ */ new Set();
+	let replacesBaseline = false;
+	for (const message of messages) {
+		const source = message.source;
+		if (source.kind !== "agent-instructions" || source.changes === void 0) continue;
+		if (source.baseline === true) {
+			replacesBaseline = true;
+			represented.clear();
+		}
+		for (const change of source.changes) {
+			if (change.action !== "remove") continue;
+			removed.add(change.path);
+			for (const [path, copy] of represented) if (copy.displayPath === change.path) represented.delete(path);
+		}
+		if (cwd === void 0 || source.baselineIdentity === void 0) continue;
+		let identity;
+		try {
+			identity = JSON.parse(source.baselineIdentity);
+		} catch {
+			continue;
+		}
+		if (typeof identity.projectRoot !== "string") continue;
+		const project = resolve(cwd, identity.projectRoot);
+		for (const change of source.changes) {
+			if (change.action === "remove" || typeof change.digest !== "string") continue;
+			if (/^(?:~|\$|user-global[\\/]|agents-global[\\/])/.test(change.path)) continue;
+			represented.set(resolve(project, change.path), {
+				digest: change.digest,
+				displayPath: change.path
+			});
+		}
+	}
+	return {
+		pathOf: (file) => {
+			const copy = represented.get(file.absolutePath);
+			return copy?.digest === createHash("sha1").update(file.content).digest("hex") ? copy.displayPath : void 0;
+		},
+		withdraws: (displayPath) => replacesBaseline || removed.has(displayPath)
+	};
+}
+//#endregion
 //#region src/instructions.ts
 /**
 * `multi-root-instructions`: the additional roots' own instruction files, made
@@ -342,16 +390,13 @@ function touchedPathOfToolCall(name, argumentsJson) {
 * The directory a touched path's instructions would live in.
 *
 * Tool arguments are the model's raw input, so a relative `file_path` is
-* resolved against the session cwd — the base the tool layer itself uses —
-* rather than against this process's cwd. Mac's `realpath` spelling is applied
-* here so the result compares against the canonical roots.
-* @param path - a touched path, absolute or relative to the session cwd.
-* @param session - the session the touch belongs to.
+* captured as an absolute path at the operation boundary. Mac's `realpath`
+* spelling is applied here so it compares against the canonical roots.
+* @param path - the absolute touched file path.
 * @returns the canonical parent directory, or `undefined` when it cannot be named.
 */
-function parentDirectoryOf(path, session) {
-	const cwd = session.header.cwd;
-	const absolute = isAbsolute(path) ? path : cwd === void 0 ? void 0 : resolve(cwd, path);
+function parentDirectoryOf(path) {
+	const absolute = isAbsolute(path) ? path : void 0;
 	if (absolute === void 0) return void 0;
 	try {
 		return canonicalPath(dirname(absolute));
@@ -385,6 +430,7 @@ function composeInstructionMessage(rendered, revoked, removed) {
 /** This row is gated on the compatibility contract like every other provider. */
 const inject = [
 	"multiRootCompat",
+	"multiRootProviders",
 	"multiRootScope",
 	"sandboxPolicy"
 ];
@@ -407,6 +453,8 @@ function apply(ctx, config = {}) {
 	if (maxBytes <= 0 || !Number.isFinite(maxBytes)) return;
 	const states = /* @__PURE__ */ new WeakMap();
 	const callsBySession = /* @__PURE__ */ new WeakMap();
+	const executions = new AsyncLocalStorage();
+	aroundTool(ctx, (exec, next) => executions.run(exec, next));
 	const stateOf = (session) => {
 		const existing = states.get(session);
 		if (existing !== void 0) return existing;
@@ -427,7 +475,8 @@ function apply(ctx, config = {}) {
 			}
 			pendingCalls.set(event.data.callId, {
 				name: event.data.name,
-				arguments: event.data.arguments
+				arguments: event.data.arguments,
+				cwd: effectiveDirectory(ctx, session)
 			});
 			return;
 		}
@@ -437,17 +486,24 @@ function apply(ctx, config = {}) {
 		pendingCalls.delete(callId);
 		if (call === void 0) return;
 		if (event.data.error !== void 0 || toolResultFailed(event.data.message)) return;
-		const path = touchedPathOfToolCall(call.name, call.arguments);
+		const path = call.observedPath ?? touchedPathOfToolCall(call.name, call.arguments);
 		if (path === void 0) return;
 		const state = stateOf(session);
 		if (state.touched.size >= MAX_TOUCHED_PATHS) return;
-		state.touched.add(path);
+		if (isAbsolute(path)) state.touched.add(path);
+		else if (call.cwd !== void 0) state.touched.add(resolve(call.cwd, path));
 	});
 	ctx.inject(["fs"], (scope) => {
+		scope.on("fs/observed", (target, _observation, actor) => {
+			const exec = executions.getStore();
+			if (exec?.agent === void 0 || FILE_TOUCH_TOOL_NAMES[exec.name] !== true || actor !== exec) return;
+			const call = callsBySession.get(exec.agent.session)?.get(exec.callId);
+			if (call !== void 0) call.observedPath = scope.fs.processPath(target);
+		});
 		scope.on("agent/pre-step", async ({ agent, messages, signal }, next) => {
 			const decision = await next();
 			if (decision.kind !== "enter") return decision;
-			const seeded = await pending(scope, states, agent, config, maxBytes, signal);
+			const seeded = await pending(scope, states, agent, config, maxBytes, signal, decision.messages);
 			if (seeded === void 0) return decision;
 			signal.throwIfAborted();
 			const lastClaimed = decision.messages.findLastIndex((message) => messages.includes(message));
@@ -455,7 +511,7 @@ function apply(ctx, config = {}) {
 				...decision,
 				messages: decision.messages.toSpliced(lastClaimed + 1, 0, seeded)
 			};
-		});
+		}, { prepend: true });
 	});
 }
 /**
@@ -471,7 +527,7 @@ function apply(ctx, config = {}) {
 * @param signal - the turn's cancellation signal.
 * @returns the message to inject, or `undefined`.
 */
-async function pending(ctx, states, agent, config, maxBytes, signal) {
+async function pending(ctx, states, agent, config, maxBytes, signal, messages) {
 	const session = agent.session;
 	const state = states.get(session) ?? {
 		scopes: /* @__PURE__ */ new Map(),
@@ -481,9 +537,12 @@ async function pending(ctx, states, agent, config, maxBytes, signal) {
 	const evaluatedTouches = new Set(state.touched);
 	let retryTouches = false;
 	const scope = ctx.multiRootScope.resolve(ctx.sandboxPolicy.resolve({ session }));
-	const granted = new Set(scope.additionalRoots);
-	const revoked = [...new Set([...state.scopes.values()].map((entry) => entry.root))].filter((root) => !granted.has(root));
 	const rendered = [];
+	const nativeCopy = nativeInstructionCopies(messages, effectiveDirectory(ctx, session));
+	for (const [key, entry] of state.scopes) if (entry.nativePath !== void 0 && nativeCopy.withdraws(entry.nativePath)) state.scopes.set(key, {
+		...entry,
+		digest: void 0
+	});
 	const gone = [];
 	const updates = [];
 	if (scope.additionalRoots.length > 0) {
@@ -492,14 +551,29 @@ async function pending(ctx, states, agent, config, maxBytes, signal) {
 			let remaining = maxBytes;
 			for (const root of scope.additionalRoots) {
 				signal.throwIfAborted();
-				const plan = await planRoot(ctx, api, root, config, state, session, signal);
+				const plan = await planRoot(ctx, api, root, config, state, signal);
 				gone.push(...plan.gone);
 				if (plan.deliveries.length === 0) continue;
 				if (remaining <= 0) {
 					retryTouches = true;
 					continue;
 				}
-				const { text, omitted, truncated } = api.render(plan.deliveries.map((entry) => entry.file), { maxBytes: remaining });
+				const deliveries = plan.deliveries.filter((entry) => {
+					const nativePath = nativeCopy.pathOf(entry.file);
+					if (nativePath === void 0) return true;
+					updates.push({
+						key: entry.key,
+						scope: {
+							root,
+							path: entry.file.absolutePath,
+							digest: digestOf(entry.file.content),
+							nativePath
+						}
+					});
+					return false;
+				});
+				if (deliveries.length === 0) continue;
+				const { text, omitted, truncated } = api.render(deliveries.map((entry) => entry.file), { maxBytes: remaining });
 				const omittedPaths = new Set(omitted.map((file) => file.absolutePath));
 				const truncatedPaths = new Set(truncated.map((file) => file.displayPath));
 				if (omitted.length > 0 || truncated.length > 0 || text === "") retryTouches = true;
@@ -509,7 +583,7 @@ async function pending(ctx, states, agent, config, maxBytes, signal) {
 					root,
 					text
 				});
-				for (const entry of plan.deliveries) {
+				for (const entry of deliveries) {
 					if (omittedPaths.has(entry.file.absolutePath)) continue;
 					updates.push({
 						key: entry.key,
@@ -523,17 +597,20 @@ async function pending(ctx, states, agent, config, maxBytes, signal) {
 			}
 		}
 	}
-	const text = composeInstructionMessage(rendered, revoked, gone.map((entry) => entry.scope));
+	const current = new Set(ctx.multiRootScope.resolve(ctx.sandboxPolicy.resolve({ session })).additionalRoots);
+	const revoked = [...new Set([...state.scopes.values()].map((entry) => entry.root))].filter((root) => !current.has(root));
+	const liveUpdates = updates.filter((entry) => current.has(entry.scope.root));
+	const text = composeInstructionMessage(rendered.filter((entry) => current.has(entry.root)), revoked, gone.filter((entry) => current.has(entry.scope.root)).map((entry) => entry.scope));
 	const message = text === void 0 ? void 0 : await createInstructionMessage({
 		text,
 		plugin: PLUGIN_SOURCE
 	});
 	signal.throwIfAborted();
 	if (!retryTouches) for (const touch of evaluatedTouches) state.touched.delete(touch);
-	if (text !== void 0) {
+	if (text !== void 0 || liveUpdates.length > 0) {
 		for (const root of revoked) for (const [key, entry] of state.scopes) if (entry.root === root) state.scopes.delete(key);
 		for (const entry of gone) state.scopes.delete(entry.key);
-		for (const entry of updates) state.scopes.set(entry.key, entry.scope);
+		for (const entry of liveUpdates) state.scopes.set(entry.key, entry.scope);
 	}
 	return message;
 }
@@ -554,11 +631,10 @@ async function pending(ctx, states, agent, config, maxBytes, signal) {
 * @param root - the canonical additional root.
 * @param config - the row's configuration.
 * @param state - the session's delivery state.
-* @param session - the session, for the cwd a relative touch resolves against.
 * @param signal - the turn's cancellation signal.
 * @returns the files to send and the deliveries to withdraw.
 */
-async function planRoot(ctx, api, root, config, state, session, signal) {
+async function planRoot(ctx, api, root, config, state, signal) {
 	const delivered = /* @__PURE__ */ new Map();
 	for (const [key, entry] of state.scopes) if (entry.root === root) delivered.set(key, entry);
 	const dirs = /* @__PURE__ */ new Set([root]);
@@ -567,7 +643,7 @@ async function planRoot(ctx, api, root, config, state, session, signal) {
 		if (dir !== root) dirs.add(dir);
 	}
 	for (const touched of state.touched) {
-		const parent = parentDirectoryOf(touched, session);
+		const parent = parentDirectoryOf(touched);
 		if (parent === void 0 || !isCanonicallyUnder(parent, root)) continue;
 		let dir = parent;
 		for (;;) {
@@ -678,16 +754,21 @@ async function loadDirectory(fs, api, root, config, signal, cwd) {
 	}
 	const files = [];
 	for (const candidate of candidates) {
+		if (isAbsolute(candidate.displayPath) || resolve(root, candidate.displayPath) !== resolve(candidate.absolutePath)) continue;
 		if (!isCanonicallyUnder(canonicalPath(candidate.absolutePath), root)) continue;
 		try {
 			const target = await fs.resolve(candidate.absolutePath);
+			const path = fs.processPath(target);
+			if (!isCanonicallyUnder(path, root)) continue;
 			const info = await fs.stat(target, signal);
 			if (info === void 0 || info.type !== "file") continue;
 			if (info.size !== void 0 && info.size > maxSourceBytes) continue;
+			const content = await fs.readText(target, signal);
+			if (canonicalPath(candidate.absolutePath) !== path || !isCanonicallyUnder(path, root)) continue;
 			files.push({
 				...candidate,
 				displayPath: candidate.absolutePath,
-				content: await fs.readText(target, signal)
+				content
 			});
 		} catch {
 			continue;

package/lib/instructions.js

@@ -1,2 +1,2 @@
-import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-Cn1Jj5Xi.js";
+import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-D19jRxN0.js";
 export { DEFAULT_MAX_BYTES, DEFAULT_MAX_SOURCE_BYTES, PLUGIN_SOURCE, apply, composeInstructionMessage, inject, touchedPathOfToolCall };

package/lib/lsp.js

@@ -0,0 +1,43 @@
+import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/lsp.ts
+const inject = [
+	"multiRootCompat",
+	"multiRootProviders",
+	"multiRootScope"
+];
+function apply(ctx) {
+	const callers = new AsyncLocalStorage();
+	aroundTool(ctx, (exec, next) => exec.agent === void 0 ? next() : callers.run(exec.agent.session, next));
+	ctx.inject(["lsp", "fs"], (scope) => {
+		const service = scope.get("lsp");
+		scope.effect(() => wrapMethod(service, "query", (original) => async function(request, signal) {
+			const session = callers.getStore();
+			const primary = session === void 0 ? request.workspaceRoot : session.header.cwd ?? scope.get("sandboxPolicy")?.resolve({ session }).workspaceRoot;
+			if (primary === void 0) throw new Error("multi-root workspace: LSP caller has no session origin or deployment policy");
+			if (scope.multiRootScope.scopeOf(primary).length === 0 && session === void 0) return original.call(this, request, signal);
+			const route = await routeWorkspacePath(scope, primary, request.filePath, signal, request.workspaceRoot);
+			if (route === void 0) {
+				const target = await scope.fs.resolve(request.filePath, {
+					cwd: request.workspaceRoot,
+					...signal === void 0 ? {} : { signal }
+				});
+				return original.call(this, {
+					...request,
+					workspaceRoot: primary,
+					filePath: scope.fs.processPath(target)
+				}, signal);
+			}
+			if (session === void 0 && route.workspaceRoot === route.primaryRoot) return original.call(this, request, signal);
+			return original.call(this, {
+				...request,
+				workspaceRoot: route.workspaceRoot,
+				filePath: route.absolutePath
+			}, signal);
+		}), "multi-root:lsp routing");
+	});
+}
+//#endregion
+export { apply, inject };

package/lib/method-wrapper-CFY3p3j2.js

@@ -0,0 +1,26 @@
+//#region src/method-wrapper.ts
+/** Wrap a public method on a Cordis service without capturing a caller-context proxy. */
+function wrapMethod(target, key, wrap) {
+	const own = Object.getOwnPropertyDescriptor(target, key);
+	let prototype = target;
+	let descriptor;
+	while (prototype !== null && descriptor === void 0) {
+		descriptor = Object.getOwnPropertyDescriptor(prototype, key);
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	if (typeof descriptor?.value !== "function") throw new Error(`multi-root: ${String(key)} is not a public method`);
+	const value = wrap(descriptor.value);
+	Object.defineProperty(target, key, {
+		configurable: true,
+		writable: true,
+		enumerable: own?.enumerable ?? false,
+		value
+	});
+	return () => {
+		if (Object.getOwnPropertyDescriptor(target, key)?.value !== value) return;
+		if (own === void 0) Reflect.deleteProperty(target, key);
+		else Object.defineProperty(target, key, own);
+	};
+}
+//#endregion
+export { wrapMethod as t };

package/lib/process-fence.js

@@ -0,0 +1,280 @@
+import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/compat/process-result.ts
+const object$1 = (value) => typeof value === "object" && value !== null;
+const thenable = (value) => typeof value?.then === "function";
+const textOf = (value) => typeof value === "string" ? value : object$1(value) && typeof value.text === "string" ? value.text : "";
+const stderrOf = (value) => textOf(value.stderr) + (object$1(value.error) ? textOf(value.error.message) : "") + (object$1(value.failure) ? textOf(value.failure.message) : "");
+const exitCodeOf = (value) => typeof value.exitCode === "number" || value.exitCode === null ? value.exitCode : value.ok === false || object$1(value.error) || object$1(value.failure) ? 1 : 0;
+/** Denial and runner-failure verdicts for one settled process — the same
+* non-zero-exit + stderr-signature rules the sandbox executors apply: a fatal
+* runner line is an infrastructure failure, never a policy denial. */
+const classifyOutcome = (exitCode, stderr, facts) => {
+	const nonzero = exitCode !== null && exitCode !== 0;
+	const lines = stderr.toLowerCase().split(/\r?\n/);
+	const runnerFailed = nonzero && facts.runnerFailureRules.some((rule) => (rule.allowedExitCodes === void 0 || rule.allowedExitCodes.includes(exitCode)) && lines.some((line) => !rule.informationalLines?.some((info) => info.toLowerCase() === line) && rule.fatalSignatures.some((signature) => line.includes(signature.toLowerCase()))));
+	return {
+		denied: nonzero && !runnerFailed && facts.denialSignatures.some((signature) => stderr.toLowerCase().includes(signature.toLowerCase())),
+		runnerFailed
+	};
+};
+/** The `sandbox` stamp one settled outcome carries, merged over any stamp the
+* confining executor already installed. */
+const sandboxStamp = (value, facts, policy, stderr) => {
+	const { denied, runnerFailed } = classifyOutcome(exitCodeOf(value), stderr ?? stderrOf(value), facts);
+	return {
+		...object$1(value.sandbox) ? value.sandbox : {},
+		mode: policy.mode,
+		enforcement: facts.enforcement,
+		denied,
+		...runnerFailed ? { runnerFailed: true } : {}
+	};
+};
+function stampProcessResult(value, facts, policy) {
+	if (!object$1(value)) return value;
+	return {
+		...value,
+		sandbox: sandboxStamp(value, facts, policy)
+	};
+}
+/** Whether a non-thenable, non-`result()` value is a live process handle
+* rather than settled result data: it owns a `done` settle hook or callable
+* members, or carries a shaped prototype. Copying it would freeze
+* `status`/`exitCode` where consumers poll them and sever `readOutput`/`kill`
+* identity — the model-facing `proc.sandbox` read happens on this very
+* object, so the stamp must land in place.
+*/
+const liveHandle = (value) => thenable(value.done) || typeof value.done === "function" || Object.values(value).some((member) => typeof member === "function") || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null;
+function decorateProcessOutcome(value, facts, policy, diagnostics) {
+	if (object$1(value) && typeof value.then === "function") return value.then((result) => decorateProcessOutcome(result, facts, policy, diagnostics));
+	if (object$1(value) && typeof value.result === "function") {
+		let cached;
+		let settled = false;
+		wrapMethod(value, "result", (original) => function(...args) {
+			if (!settled) {
+				cached = decorateProcessOutcome(original.apply(this, args), facts, policy, diagnostics);
+				settled = true;
+			}
+			return cached;
+		});
+		return value;
+	}
+	if (object$1(value) && liveHandle(value)) {
+		const settle = () => {
+			try {
+				value.sandbox = sandboxStamp(value, facts, policy, diagnostics?.stderr?.());
+			} catch {}
+		};
+		if (thenable(value.done)) {
+			value.done = value.done.then((outcome) => {
+				settle();
+				return decorateProcessOutcome(outcome, facts, policy, diagnostics);
+			}, (error) => {
+				settle();
+				throw error;
+			});
+			return value;
+		}
+		if (typeof value.done === "function") {
+			wrapMethod(value, "done", (original) => function(...args) {
+				const outcome = original.apply(this, args);
+				return thenable(outcome) ? outcome.then((resolved) => {
+					settle();
+					return decorateProcessOutcome(resolved, facts, policy, diagnostics);
+				}, (error) => {
+					settle();
+					throw error;
+				}) : (settle(), decorateProcessOutcome(outcome, facts, policy, diagnostics));
+			});
+			return value;
+		}
+		settle();
+		return value;
+	}
+	return stampProcessResult(value, facts, policy);
+}
+//#endregion
+//#region src/compat/process-entrypoints.ts
+/**
+* The public shell executor entries present on the mounted service, in this
+* order: `execute`, `run`, `start` (`start` existed through 0.1.6).
+* @param shell - the mounted `ctx.shell` service.
+* @returns the present entries — a structural probe only.
+*/
+function shellEntrypoints(shell) {
+	const record = shell;
+	return [
+		"execute",
+		"run",
+		"start"
+	].filter((key) => typeof record[key] === "function");
+}
+/**
+* The PTC runtime's public entry: `['run']` when it is a function; never the
+* concrete runtime's private `execute` helper.
+* @param runtime - the mounted `ctx.ptcRuntime` service.
+* @returns the present entries — a structural probe only.
+*/
+function ptcEntrypoints(runtime) {
+	return typeof runtime.run === "function" ? ["run"] : [];
+}
+//#endregion
+//#region src/process-fence.ts
+/**
+* `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
+* never sees — `danger-full-access` with explicit `read-only` additional roots.
+*
+* Upstream, every confined consumer routes through `ctx.sandbox.confine`, which
+* this bundle's provider already widens (grants, the read-only fixed-write
+* graft, and the workspace-write deny edge). But the shell executor, the PTC
+* runtime and the PTY backend all short-circuit that mode: `policy.mode ===
+* 'danger-full-access'` returns the bare argv, so an explicit `read-only` root
+* would silently stay writable. This row closes the gap without touching any
+* upstream executor:
+*
+* - `ctx.subprocess.spawn` is wrapped to prepend a precomputed restricted
+*   profile whenever the AsyncLocalStorage below carries one. `spawn` is
+*   synchronous, so the profile — which never depends on the callee's argv —
+*   is built by the wrapping consumer, not here.
+* - `ctx.shell.execute` (bash and pwsh alike, and `start` where an older
+*   release still exposes it — `compat/process-entrypoints.ts` owns which
+*   entries a mounted executor actually carries) resolves the per-call policy
+*   exactly the way the executor itself does, and — under Full-access with
+*   deny roots — asks the sandbox provider for the restricted prefix and runs
+*   the call inside the store, so every subprocess the executor launches is
+*   confined.
+* - `ctx.ptcRuntime.run` does the same for `run_code`.
+* - `ctx.subprocess.spawnTerminal` keys on the `DSH_PTY_SESSION_ID` marker:
+*   every supported `dsh-terminal-bash` backend stamps it (alongside
+*   `DSH_SESSION_ID`) when it launches an agent's PTY, and no other caller —
+*   above all the panel's terminal controller — ever sets it. A spec without
+*   the marker is a USER terminal, passed through untouched in every mode:
+*   the sandbox protects agent behavior, and upstream never confines the
+*   user's own terminal. Because that marker is the ONLY discriminator, the
+*   `multi-root-compat` gate asserts it at boot (`compat/pty-marker.ts`):
+*   an installed backend whose emitted code no longer stamps it fails the
+*   plugin load rather than silently reclassifying agent PTYs as the user's.
+*   `ctx.terminals` itself is deliberately NOT wrapped:
+*   upstream mounts it inside `optional-persistent-terminals` with
+*   `isolate: { terminals: true }`, so the registry entry is unreachable from
+*   this row — the shared `spawnTerminal` seam plus the env discriminator
+*   covers both the un-isolated SDK mount and the isolated web mount.
+*
+* The same seam carries the unknown-authority downgrade: while the scope
+* reports `authority: 'unavailable'` — a contended, storage-failed or
+* config-invalid registry publishes an empty deny set that is NOT evidence —
+* `danger-full-access` executions run inside a primary-root-only
+* profile (with the deny set applied) instead of ambient.
+*
+* Windows uses the standalone ambient deny-token runner. Landlock cannot subtract a subtree, so that combination selects bubblewrap.
+* An unusable mount runner fails without starting an unconfined process.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/process-fence
+*/
+const inject = [
+	"multiRootCompat",
+	"multiRootProviders",
+	"multiRootScope",
+	"sandbox",
+	"sandboxPolicy"
+];
+const processDenyStore = new AsyncLocalStorage();
+/** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
+function isThenable(value) {
+	return typeof value?.then === "function";
+}
+const object = (value) => typeof value === "object" && value !== null;
+function apply(ctx) {
+	const policyOf = (spec) => spec?.sandboxPolicy ?? ctx.sandboxPolicy.resolve();
+	/**
+	* The confined facts for one Full-access call, or `undefined` when the call
+	* needs no confinement (not full-access, and nothing to deny while the
+	* registry is the store's authority). An `unavailable` scope authority
+	* clamps the call to a primary-root-only profile: the empty deny
+	* set a contended or failed registry publishes is not evidence that nothing
+	* is restricted. May throw synchronously — `SandboxUnavailableError` from a
+	* dialect that cannot express the confinement, which must propagate to the
+	* caller, never be swallowed.
+	*/
+	const prepare = (policy, signal) => {
+		if (policy.mode !== "danger-full-access") return void 0;
+		const scope = ctx.multiRootScope.resolve(policy);
+		if (scope.authority === "unavailable") return ctx.sandbox.clampedExecution(policy, scope.deniedRoots, signal);
+		if (scope.deniedRoots.length === 0) return void 0;
+		return ctx.sandbox.restrictedExecution(policy, scope.deniedRoots, signal, scope.protectedHome);
+	};
+	/**
+	* Run `body` under the restricted deny context when `prepared` is a prefix —
+	* preserving the sync/async shape of the prepared value itself.
+	*/
+	const runDenied = (prepared, policy, body) => {
+		const run = (facts) => {
+			const store = { argvPrefix: facts.argv };
+			return processDenyStore.run(store, () => decorateProcessOutcome(body(), facts, policy, { stderr: () => store.stderr?.() }));
+		};
+		return isThenable(prepared) ? prepared.then(run) : run(prepared);
+	};
+	ctx.inject(["subprocess"], (scope) => {
+		scope.effect(() => wrapMethod(scope.subprocess, "spawn", (original) => function(spec) {
+			const store = processDenyStore.getStore();
+			if (store === void 0) return original.call(this, spec);
+			const handle = original.call(this, {
+				...spec,
+				argv: [...store.argvPrefix, ...spec.argv]
+			});
+			const stderr = object(handle) && object(handle.collected) && object(handle.collected.stderr) && typeof handle.collected.stderr.readFrom === "function" ? handle.collected.stderr : void 0;
+			if (stderr !== void 0) store.stderr = () => {
+				try {
+					return stderr.readFrom(0).text;
+				} catch {
+					return;
+				}
+			};
+			return handle;
+		}));
+		scope.effect(() => wrapMethod(scope.subprocess, "spawnTerminal", (original) => async function(spec) {
+			const ptySessionId = spec.env?.DSH_PTY_SESSION_ID;
+			if (ptySessionId === void 0 || ptySessionId === "") return await original.call(this, spec);
+			const sessionId = spec.env?.DSH_SESSION_ID;
+			const session = sessionId === void 0 || sessionId === "" ? void 0 : ctx.get("sessions")?.get(sessionId);
+			if (session === void 0) {
+				if (!ctx.multiRootScope.hasActiveDenyRoots()) return await original.call(this, spec);
+				throw new Error(`multi-root workspace: agent terminal spawn carries a session marker that does not resolve to a live session (${JSON.stringify(sessionId ?? ptySessionId)}), and explicit read-only roots are or may be registered — refusing to spawn an unconfined terminal`);
+			}
+			const policy = ctx.sandboxPolicy.resolve({ session });
+			const prepared = prepare(policy, spec.signal);
+			if (prepared === void 0) return await original.call(this, spec);
+			const argvPrefix = (await prepared).argv;
+			return await original.call(this, {
+				...spec,
+				argv: [...argvPrefix, ...spec.argv]
+			});
+		}));
+	});
+	/**
+	* The wrapper every execute-style consumer entry shares: resolve the policy
+	* the way the upstream consumer does, and when the call runs ambient under
+	* Full-access with roots to deny, execute it inside the restricted store so
+	* every subprocess it launches is confined.
+	*/
+	const deniedEntry = (scope, target, key) => {
+		scope.effect(() => wrapMethod(target, key, (original) => function(spec, ...rest) {
+			const policy = policyOf(spec);
+			const prepared = prepare(policy, spec?.signal);
+			if (prepared === void 0) return original.call(this, spec, ...rest);
+			return runDenied(prepared, policy, () => original.call(this, spec, ...rest));
+		}));
+	};
+	ctx.inject(["shell"], (scope) => {
+		const shell = scope.get("shell");
+		if (shell === void 0) return;
+		for (const key of shellEntrypoints(shell)) deniedEntry(scope, shell, key);
+	});
+	ctx.inject(["ptcRuntime"], (scope) => {
+		const runtime = scope.get("ptcRuntime");
+		if (runtime === void 0) return;
+		for (const key of ptcEntrypoints(runtime)) deniedEntry(scope, runtime, key);
+	});
+}
+//#endregion
+export { apply, inject };