@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/lib/types/client/open-in-app/open-failure-toast.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from 'react';
+/**
+ * Transient failure banner owned by the control that initiated the gesture,
+ * so one failed request announces once, from the control the user pressed.
+ * @returns `toast` owned by the control and `show` to announce one
+ * failure with resolved copy; announcing again replays the banner.
+ */
+export declare function useOpenFailureToast(): {
+    toast: ReactNode;
+    show: (text: string) => void;
+};

package/lib/types/client/open-in-app/open-path.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fork-facing shim for upstream `ui-open-in-app/src/client/open-path.ts`.
+ *
+ * The fork only needs the failure union `OpenInAppPathButton`'s `execute`
+ * returns; upstream's file also carries `OpenInAppPathController`, the
+ * document-preview path controller that speaks to a Session Remote this
+ * plugin does not hold. Keeping the verbatim file would pull
+ * `@deepseek-ai/dsh-api-remotes` and `dsh-api-session-controller` into the
+ * bundle for a class nothing here calls — so this shim owns just the type,
+ * spelled verbatim. See FORK.md.
+ */
+/** Failure kind of one settled path gesture, for the initiating control to announce. */
+export type OpenInAppPathFailure = 'openError' | 'revealError';

package/lib/types/client/panel-client.d.ts

@@ -43,11 +43,12 @@ export interface PanelClient {
      * @param endpoint - the endpoint name; it also selects the response type.
      * @param payload - the request fields for that endpoint (the endpoint name
      *   travels as the RPC method, so it is not repeated in the payload).
+     * @param signal - optional cancellation; aborting rejects the call.
      * @returns the host's value, in the shape the endpoint promises.
      * @throws {PanelError} when the host answered with a failure, or with a value
      *   that is not what this endpoint promises.
      */
-    call<E extends PanelEndpoint>(endpoint: E, payload: PanelRequest): Promise<PanelResponseMap[E]>;
+    call<E extends PanelEndpoint>(endpoint: E, payload: PanelRequest, signal?: AbortSignal): Promise<PanelResponseMap[E]>;
 }
 /**
  * Build the panel client over a Connection handle.

package/lib/types/client/styles.d.ts

@@ -11,4 +11,4 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/styles
  */
 /** The stylesheet text; every class is prefixed `mrfw-` to stay collision-free. */
-export declare const STYLES = "\n/* Sidebar footer row, mirroring the host ui-settings-general trigger: the row\n * wrapper overhangs each side by 2px (width calc(100% + 4px) against the\n * shell's 12px inline padding) so the icon's ink line lands at 18px from the\n * column edge \u2014 exactly where the Settings gear below sits. */\n.mrfw-triggerRow {\n  flex: none;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: calc(100% + 4px);\n  margin: 4px -2px;\n}\n\n.mrfw-triggerRow.mrfw-railRow {\n  width: 36px;\n  margin: 8px 0 10px;\n}\n\n.mrfw-trigger {\n  box-sizing: border-box;\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: auto;\n  height: 42px;\n  margin: 0;\n  padding: 0 10px 0 8px;\n  border: none;\n  border-radius: 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  text-align: left;\n  cursor: pointer;\n  overflow: hidden;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-trigger:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-triggerIcon {\n  flex: none;\n  display: inline-flex;\n}\n\n.mrfw-triggerLabel {\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.mrfw-triggerRail {\n  flex: none;\n  width: 36px;\n  height: 36px;\n  margin: 0;\n  padding: 0;\n  gap: 0;\n  border-radius: 50%;\n  justify-content: center;\n}\n\n.mrfw-overlay {\n  position: fixed;\n  inset: 0;\n  z-index: 1000;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  padding: 24px;\n}\n\n.mrfw-mask {\n  position: absolute;\n  inset: 0;\n  background: var(--dsw-alias-bg-mask-1);\n  backdrop-filter: var(--dsw-mask-blur);\n}\n\n.mrfw-dialog {\n  position: relative;\n  z-index: 1;\n  display: flex;\n  flex-direction: column;\n  width: min(640px, 100%);\n  max-height: 100%;\n  overflow: hidden;\n  border: none;\n  border-radius: 24px;\n  background: var(--dsw-alias-bg-layer-2);\n  box-shadow: var(--dsw-elevation-prominent);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  outline: none;\n}\n\n.mrfw-header {\n  flex: none;\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 8px;\n  padding: 22px 14px 12px 24px;\n}\n\n.mrfw-title {\n  margin: 0;\n  font-size: 16px;\n  line-height: 24px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-close {\n  flex: none;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 28px;\n  height: 28px;\n  border: none;\n  border-radius: 8px;\n  background: transparent;\n  cursor: pointer;\n  color: var(--dsw-alias-label-secondary);\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-close:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-body {\n  display: flex;\n  flex-direction: column;\n  min-height: 0;\n  overflow-y: auto;\n  padding: 0 24px 24px;\n}\n\n.mrfw-description {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-alert {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.mrfw-section {\n  display: flex;\n  flex-direction: column;\n}\n\n.mrfw-section + .mrfw-section {\n  margin-top: 8px;\n}\n\n.mrfw-sectionTitleRow {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  padding: 8px 0 4px;\n}\n\n.mrfw-sectionTitle {\n  font-size: 14px;\n  line-height: 22px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-sectionNote {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-row {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  padding: 12px 0;\n  border-bottom: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n.mrfw-rowBare {\n  border-bottom: none;\n}\n\n/* A root entry's two lines: the display name on top, the absolute path under\n   it in the tertiary voice (the workspace rows recipe of the host sidebar). */\n.mrfw-rootText {\n  display: flex;\n  flex: 1 1 240px;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n.mrfw-rootName {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-rootPath {\n  font-family: var(--ds-font-family-code);\n  font-size: 12px;\n  line-height: 18px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-stateWarn {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.mrfw-btn {\n  display: inline-flex;\n  flex: none;\n  align-items: center;\n  justify-content: center;\n  gap: 4px;\n  height: 28px;\n  padding: 0 10px;\n  border: none;\n  border-radius: 14px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-btn:disabled {\n  cursor: not-allowed;\n  opacity: 0.4;\n}\n\n.mrfw-btnGhost:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnGhost:active:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-active);\n}\n\n.mrfw-btnDanger:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover-danger);\n}\n\n.mrfw-btnOutline {\n  border: 0.5px solid var(--dsw-alias-border-l3);\n  background: transparent;\n}\n\n.mrfw-btnOutline:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnPrimary {\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.mrfw-btnPrimary:hover:not(:disabled) {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n/* One icon-only action: a square of the capsule family, meaning in title.\n   Declared after the .mrfw-btn family so its padding wins the cascade tie:\n   the capsule's 0 10px padding would otherwise squeeze the icon glyph. */\n.mrfw-iconBtn {\n  width: 28px;\n  padding: 0;\n  border-radius: 8px;\n}\n\n.mrfw-input {\n  flex: 1 1 220px;\n  min-width: 0;\n  height: 32px;\n  padding: 0 8px;\n  border: 0.5px solid var(--dsw-alias-border-l4);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  outline: none;\n  transition: border-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-input:focus {\n  border-color: var(--dsw-alias-brand-primary);\n}\n\n.mrfw-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.mrfw-inputInline {\n  flex: 1 1 auto;\n}\n\n.mrfw-aliasEditor {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n  flex-basis: 100%;\n}\n\n.mrfw-actions {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  margin-top: 16px;\n  padding-top: 16px;\n  border-top: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n/* One control row, one height: the capsule buttons match the 32px input. */\n.mrfw-actions .mrfw-btn {\n  height: 32px;\n  border-radius: 16px;\n}\n\n.mrfw-fileTree { flex-basis: 100%; min-width: 0; }\n.mrfw-fileLevel { list-style: none; padding-left: 16px; margin: 4px 0; }\n.mrfw-fileEntry { display: block; border: 0; background: transparent; color: var(--dsw-alias-label-primary); font: inherit; text-align: left; cursor: pointer; padding: 4px; overflow-wrap: anywhere; }\n.mrfw-fileEntry:focus-visible { outline: 1px solid var(--dsw-alias-brand-primary); }\n.mrfw-filePreview { max-height: 320px; overflow: auto; padding: 8px; background: var(--dsw-alias-bg-layer-1); color: var(--dsw-alias-label-primary); font-size: 12px; }\n.mrfw-actions .mrfw-iconBtn {\n  width: 32px;\n}\n";
+export declare const STYLES = "\n/* Sidebar footer row, mirroring the host ui-settings-general trigger: the row\n * wrapper overhangs each side by 2px (width calc(100% + 4px) against the\n * shell's 12px inline padding) so the icon's ink line lands at 18px from the\n * column edge \u2014 exactly where the Settings gear below sits. */\n.mrfw-triggerRow {\n  flex: none;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: calc(100% + 4px);\n  margin: 4px -2px;\n}\n\n.mrfw-triggerRow.mrfw-railRow {\n  width: 36px;\n  margin: 8px 0 10px;\n}\n\n.mrfw-trigger {\n  box-sizing: border-box;\n  flex: 1;\n  min-width: 0;\n  display: flex;\n  align-items: center;\n  gap: 8px;\n  width: auto;\n  height: 42px;\n  margin: 0;\n  padding: 0 10px 0 8px;\n  border: none;\n  border-radius: 12px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  text-align: left;\n  cursor: pointer;\n  overflow: hidden;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-trigger:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-triggerIcon {\n  flex: none;\n  display: inline-flex;\n}\n\n.mrfw-triggerLabel {\n  overflow: hidden;\n  white-space: nowrap;\n}\n\n.mrfw-triggerRail {\n  flex: none;\n  width: 36px;\n  height: 36px;\n  margin: 0;\n  padding: 0;\n  gap: 0;\n  border-radius: 50%;\n  justify-content: center;\n}\n\n/* Icon-only launcher inside the upstream Files tab header. Upstream's\n   FilesBody renders .header as one flat flex row \u2014 PathLabel, then the\n   reload button, then the files.actions slot occupants \u2014 and each of those\n   children carries a stable data-files-* attribute on the flex item itself\n   (data-files-root on the pane, data-files-path, data-files-reload).\n   A registration order sorts only INSIDE the actions slot and can never\n   overtake the reload button, so the launcher is moved with the flex order\n   property instead: this wrapper is the slot's root element and therefore a\n   direct flex item of .header, and order: -1 puts it ahead of every\n   order-0 sibling while the :has() rule below keeps the path first. */\n.mrfw-fileLauncher {\n  order: -1;\n  flex: none;\n  display: flex;\n  align-items: center;\n}\n\n/* Pin the upstream path label ahead of the launcher \u2014 but only while this\n   plugin is in the row: the :has() guard keeps a rule that names an\n   upstream element inert whenever the launcher is absent. The\n   :not([data-files-entry]) qualifier is load-bearing, not decorative:\n   upstream puts data-files-path on EVERY tree row too (the row's own\n   absolute path), so an unqualified selector would match the whole tree,\n   not just the header's PathLabel. Both selectors depend on upstream's DOM\n   shape, which is not part of the slot contract; if it changes, the rules\n   simply stop matching and the launcher falls back to its in-slot position \u2014\n   a silent degradation, never a broken header. */\n[data-files-root]:has(.mrfw-fileLauncher) [data-files-path]:not([data-files-entry]) {\n  order: -2;\n}\n\n/* The root switcher is the launcher's grown-up form on runtimes whose\n   files.actions owner carries absolutePath. It takes the path label's flex\n   position and stretch: order: -1 ahead of every order-0 sibling, and a\n   growing min-width:0 item so both the trigger label and the PathLabel\n   inside it can ellipsize instead of pushing the header controls out. */\n.mrfw-rootSwitcher {\n  order: -1;\n  flex: 1 1 auto;\n  min-width: 0;\n  display: flex;\n  align-items: center;\n  /* Same 4px the upstream .header puts between its own flex items, so the\n     takeover controls (reload, open-in-app fork) sit at the same offsets the\n     hidden native ones did \u2014 no drift between primary and additional state. */\n  gap: 4px;\n}\n\n/* While the switcher exists it hides the upstream path label \u2014 the\n   :has() guard again keeps the upstream-naming rule inert unless this\n   plugin is actually in the row. The switcher draws its own PathLabel of\n   the selected root next to the trigger (className mrfw-switcherPath, no\n   data-files-* attributes), so the header keeps a path in the same spot.\n   :not([data-files-entry]) is what confines this rule to the header:\n   every tree row carries data-files-path with its own path as the value,\n   and only the PathLabel carries it bare. Without the qualifier this\n   display:none would blank the entire native tree. */\n[data-files-root]:has(.mrfw-rootSwitcher) [data-files-path]:not([data-files-entry]) {\n  display: none;\n}\n\n/* While the switcher names an additional root, the native tree body and its\n   reload hide: the reload refreshes the very tree that is no longer\n   visible, and the plugin's forked tree is portaled in as the body's sibling.\n   The header still offers a reload \u2014 the switcher's own .mrfw-switcherReload\n   calls the forked face's refresh. The native tree keeps watching in the\n   background, so switching back to the primary root restores it instantly. */\n[data-files-root]:has(.mrfw-rootSwitcher[data-root-kind=\"additional\"]) [data-files-body],\n[data-files-root]:has(.mrfw-rootSwitcher[data-root-kind=\"additional\"]) [data-files-reload] {\n  display: none;\n}\n\n/* While the switcher names an additional root, the native open-in-app split\n   button hides too: its slot props carry the pane's primary root, so it\n   would always open the primary root no matter what the switcher selected.\n   The header gets the plugin's own fork of that same control instead (the\n   open-in-app directory), wired to the selected root.\n\n   The slot's render site is wrapped in the renderer's own anchor \u2014\n   <div data-slot=\"sidebar.right.tab.files.actions\" style=\"display:contents\">\n   \u2014 so the header's flex items inside it are the occupants themselves, and\n   the native item is the ui-primitives Menu anchor span wrapping the marked\n   .split. The first selector hides that occupant item through the data-slot\n   anchor: hiding only the inner control would leave the empty anchor span\n   as a zero-width flex item whose header gap pushes the fork 4px left of\n   the native position. The wrapper itself can never be the target \u2014 its\n   inline display:contents beats any stylesheet rule, and hiding it would\n   take the switcher with it. The second selector is the fallback for an\n   upstream that moves the attribute off the item. The fork survives both:\n   the only data-open-target inside .mrfw-rootSwitcher is its own\n   .mrfw-openSplit, which :not() excludes. */\n[data-files-root]:has(.mrfw-rootSwitcher[data-root-kind=\"additional\"]) [data-slot=\"sidebar.right.tab.files.actions\"] > *:has([data-open-target=\"directory\"]:not(.mrfw-openSplit)),\n[data-files-root]:has(.mrfw-rootSwitcher[data-root-kind=\"additional\"]) [data-open-target=\"directory\"]:not(.mrfw-openSplit) {\n  display: none;\n}\n\n/* The trigger borrows the path label's look: quiet text with a folder\n   glyph, the hover of the neighboring header buttons, and the overflow\n   behavior PathLabel itself uses in a narrow header. It may shrink but\n   never grows \u2014 the PathLabel after it owns the free header space. */\n.mrfw-rootSwitchBtn {\n  flex: 0 1 auto;\n  min-width: 0;\n  display: inline-flex;\n  align-items: center;\n  gap: 4px;\n  height: 28px;\n  margin: 0;\n  padding: 0 4px;\n  border: none;\n  border-radius: 8px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: inherit;\n  line-height: 20px;\n  text-align: left;\n  cursor: pointer;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-rootSwitchBtn:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-rootSwitchBtn .mrfw-triggerIcon {\n  color: var(--dsw-alias-label-secondary);\n}\n\n.mrfw-rootSwitchLabel {\n  min-width: 0;\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.mrfw-rootSwitchChevron {\n  margin-left: auto;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n/* The selected root's full path sits between the trigger and the reload \u2014\n   the very PathLabel upstream draws there, so it brings its own grow,\n   left-clip and hover-title behavior; only the gutters are ours. The right\n   margin plus the container gap reproduces upstream's .path margin-right\n   12px + header gap 4px; the left gutter comes from the same container gap. */\n.mrfw-switcherPath {\n  margin: 0 12px 0 0;\n}\n\n/* The takeover's own reload, standing exactly where the hidden native one\n   did: the upstream .tool recipe verbatim (28px hit area, 15px glyph,\n   secondary voice, hover fills). It calls the forked face's refresh \u2014 an\n   in-place re-list, not a remount. */\n.mrfw-switcherReload {\n  flex: none;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 28px;\n  height: 28px;\n  padding: 6px;\n  border: none;\n  border-radius: var(--dsw-radius-sm);\n  background: transparent;\n  color: var(--dsw-alias-label-secondary);\n  line-height: 1;\n  cursor: pointer;\n}\n\n.mrfw-switcherReload:hover {\n  color: var(--dsw-alias-label-primary);\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n/* \u2500\u2500 files-tree fork (verbatim rules, renamed classes) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n   Copied from upstream's FilesBody.module.css (ui-sidebar-files @\n   0.2.1-alpha.2) with local names mapped to mrfw-ft* so the rules cannot\n   collide with host DOM \u2014 and so the fork's own body (which must NOT carry\n   data-files-body) stays visible while the rules above hide the native one.\n   The header-only rules (root/header/path/tool/status/statusLine/titleIcon)\n   belong to the upstream shell this fork drops and are not mapped. Fork sync\n   re-diffs the upstream file and re-applies the rename \u2014 see\n   src/client/files-tree/FORK.md. */\n\n/* The pane's own .root already supplies the flex column, color, and font;\n   the fork's body takes the same stretch item the hidden native body held,\n   including the workspace list's 2px scrollbar offset and stable gutter. */\n.mrfw-ftBody {\n  flex: 1 1 auto;\n  min-height: 0;\n  margin-right: 2px;\n  padding: 8px 0 8px 8px;\n  overflow: auto;\n  scrollbar-gutter: stable;\n}\n\n.mrfw-ftBody::-webkit-scrollbar-track {\n  margin: 2px;\n}\n\n.mrfw-ftLevel {\n  margin: 0;\n  padding: 0;\n  list-style: none;\n}\n\n.mrfw-ftLevel .mrfw-ftLevel {\n  padding-left: 18px;\n}\n\n.mrfw-ftItem {\n  margin: 0;\n  padding: 0;\n}\n\n/* Rows abut, so the hover fill is the whole row; the tree's air is this\n   inset, not a gap between rows. */\n.mrfw-ftRow {\n  display: flex;\n  gap: 6px;\n  align-items: center;\n  width: 100%;\n  min-width: 0;\n  padding: 5px 10px;\n  color: inherit;\n  font: inherit;\n  text-align: left;\n  background: transparent;\n  border: 0;\n  border-radius: var(--dsw-radius-md);\n  cursor: pointer;\n}\n\n.mrfw-ftRow:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n/* The folder glyph rides the tertiary ink, as the workspace tree's does. */\n.mrfw-ftIcon {\n  flex: 0 0 auto;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n/* The type's coloured sheet at the folder glyph's 16px; its colour is its own. */\n.mrfw-ftFileIcon {\n  flex: 0 0 auto;\n}\n\n.mrfw-ftName {\n  min-width: 0;\n  overflow: hidden;\n  white-space: nowrap;\n  text-overflow: ellipsis;\n}\n\n/* Neither a file nor a directory: shown so the directory is reported whole,\n   greyed so nobody tries to open it. */\n.mrfw-ftOther {\n  color: var(--dsw-alias-label-tertiary);\n  cursor: default;\n}\n\n.mrfw-ftOther:hover {\n  background: transparent;\n}\n\n.mrfw-ftNote {\n  margin: 0;\n  padding: 3px 10px;\n  color: var(--dsw-alias-label-tertiary);\n  font-size: 12px;\n}\n\n/* \u2500\u2500 open-in-app fork (verbatim rules, renamed classes) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n   Copied from upstream's OpenTargetButton.module.css\n   (dsh-client-ui-open-in-app @ 0.2.1-alpha.2) with local names mapped to\n   mrfw-open* so the rules cannot collide with host DOM. Fork sync re-diffs\n   the upstream file and re-applies the rename \u2014 see\n   src/client/open-in-app/FORK.md. */\n\n/* Sized to sit in the document header's 24px control row beside its round\n   icon buttons: a hairline pill with a 12px label and a narrow chevron half. */\n.mrfw-openMenuAnchor {\n  display: inline-flex;\n  flex: none;\n  align-self: center;\n}\n\n.mrfw-openSplit {\n  display: inline-flex;\n  align-items: stretch;\n  box-sizing: border-box;\n  height: 24px;\n  overflow: hidden;\n  border: 0.5px solid var(--dsw-alias-border-l4);\n  border-radius: var(--dsw-radius-sm);\n  font-family: var(--dsw-font-family);\n}\n\n.mrfw-openMain,\n.mrfw-openChevron {\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  border: 0;\n  background: none;\n  color: var(--dsw-alias-label-primary);\n  font-size: 11px;\n  line-height: 16px;\n  white-space: nowrap;\n  cursor: pointer;\n}\n\n.mrfw-openMain {\n  gap: 4px;\n  padding: 3px 5px;\n}\n\n.mrfw-openChevron {\n  padding: 3px 4px 3px 3px;\n  border-left: 0.5px solid var(--dsw-alias-border-l4);\n  color: var(--dsw-alias-label-secondary);\n}\n\n.mrfw-openMain:hover:not(:disabled),\n.mrfw-openMain:focus-visible,\n.mrfw-openChevron:hover:not(:disabled),\n.mrfw-openChevron:focus-visible {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n/* Pending disables clicks without a restyle; only hover feedback pauses. */\n.mrfw-openMain:disabled,\n.mrfw-openChevron:disabled {\n  cursor: default;\n}\n\n.mrfw-openAppIcon {\n  object-fit: contain;\n}\n\n/* The unavailable preview emphasizes the same actions with a labeled button. */\n.mrfw-openSplit[data-size='large'] {\n  height: 36px;\n  border-radius: var(--dsw-radius-md);\n  border-color: var(--dsw-alias-border-l2);\n}\n\n.mrfw-openSplit[data-size='large'] .mrfw-openMain {\n  gap: 6px;\n  padding: 6px 14px;\n  font-size: 14px;\n}\n\n.mrfw-openSplit[data-size='large'] .mrfw-openChevron {\n  padding: 6px 10px;\n}\n\n.mrfw-openSkeleton { display: inline-block; flex: none; border-radius: var(--dsw-radius-xs); background: var(--dsw-alias-interactive-bg-hover); }\n\n.mrfw-overlay {\n  position: fixed;\n  inset: 0;\n  z-index: 1000;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  padding: 24px;\n}\n\n.mrfw-mask {\n  position: absolute;\n  inset: 0;\n  background: var(--dsw-alias-bg-mask-1);\n  backdrop-filter: var(--dsw-mask-blur);\n}\n\n.mrfw-dialog {\n  position: relative;\n  z-index: 1;\n  display: flex;\n  flex-direction: column;\n  width: min(640px, 100%);\n  max-height: 100%;\n  overflow: hidden;\n  border: none;\n  border-radius: 24px;\n  background: var(--dsw-alias-bg-layer-2);\n  box-shadow: var(--dsw-elevation-prominent);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  outline: none;\n}\n\n.mrfw-header {\n  flex: none;\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 8px;\n  padding: 22px 14px 12px 24px;\n}\n\n.mrfw-title {\n  margin: 0;\n  font-size: 16px;\n  line-height: 24px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-close {\n  flex: none;\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 28px;\n  height: 28px;\n  border: none;\n  border-radius: 8px;\n  background: transparent;\n  cursor: pointer;\n  color: var(--dsw-alias-label-secondary);\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-close:hover {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-body {\n  display: flex;\n  flex-direction: column;\n  min-height: 0;\n  overflow-y: auto;\n  padding: 0 24px 24px;\n}\n\n.mrfw-description {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-alert {\n  margin: 0 0 8px;\n  font-size: 14px;\n  line-height: 22px;\n  color: var(--dsw-alias-state-error-primary);\n}\n\n.mrfw-section {\n  display: flex;\n  flex-direction: column;\n}\n\n.mrfw-section + .mrfw-section {\n  margin-top: 8px;\n}\n\n.mrfw-sectionTitleRow {\n  display: flex;\n  align-items: baseline;\n  gap: 8px;\n  padding: 8px 0 4px;\n}\n\n.mrfw-sectionTitle {\n  font-size: 14px;\n  line-height: 22px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-sectionNote {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-row {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  padding: 12px 0;\n  border-bottom: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n.mrfw-rowBare {\n  border-bottom: none;\n}\n\n/* A root entry's two lines: the display name on top, the absolute path under\n   it in the tertiary voice (the workspace rows recipe of the host sidebar). */\n.mrfw-rootText {\n  display: flex;\n  flex: 1 1 240px;\n  flex-direction: column;\n  gap: 2px;\n  min-width: 0;\n}\n\n/* The name line is a flex row: the truncating name text first, the access\n   badge beside it never shrinking \u2014 baseline-aligned so the badge's smaller\n   voice sits on the name's baseline rather than its middle. */\n.mrfw-rootName {\n  display: flex;\n  align-items: baseline;\n  gap: 6px;\n  min-width: 0;\n  overflow: hidden;\n  font-size: 14px;\n  line-height: 20px;\n  font-weight: 500;\n  color: var(--dsw-alias-label-primary);\n}\n\n.mrfw-rootNameText {\n  overflow: hidden;\n  text-overflow: ellipsis;\n  white-space: nowrap;\n}\n\n.mrfw-rootPath {\n  font-family: var(--ds-font-family-code);\n  font-size: 12px;\n  line-height: 18px;\n  word-break: break-all;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n/* The path doubles as the copy control: an unstyled button that keeps the\n   text recipe and makes the whole string clickable \u2014 the whole region, not\n   just the icon, copies on click. */\n.mrfw-pathCopy {\n  display: block;\n  width: 100%;\n  padding: 0;\n  border: 0;\n  background: transparent;\n  text-align: left;\n  cursor: pointer;\n}\n\n/* The trailing icon stays in flow but invisible until the path is hovered\n   or focused: appearing never re-wraps the text, and the icon inherits the\n   path's own tertiary ink. */\n.mrfw-pathCopyIcon {\n  display: inline-flex;\n  margin-left: 4px;\n  vertical-align: -2px;\n  opacity: 0;\n  transition: opacity var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-pathCopy:hover .mrfw-pathCopyIcon,\n.mrfw-pathCopy:focus-visible .mrfw-pathCopyIcon {\n  opacity: 1;\n}\n\n.mrfw-note {\n  margin: 0;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-stateWarn {\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-state-warn-primary);\n}\n\n.mrfw-btn {\n  display: inline-flex;\n  flex: none;\n  align-items: center;\n  justify-content: center;\n  gap: 4px;\n  height: 28px;\n  padding: 0 10px;\n  border: none;\n  border-radius: 14px;\n  background: transparent;\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 12px;\n  line-height: 18px;\n  cursor: pointer;\n  transition: background-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-btn:disabled {\n  cursor: not-allowed;\n  opacity: 0.4;\n}\n\n.mrfw-btnGhost:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnGhost:active:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-active);\n}\n\n/* The solid destructive action of the capsule family: the upgrade confirm's\n   red button. state-error-primary is the error ink upstream also uses as a\n   fill (StateDot); the hover mixes in the host's primary label token to\n   follow its theme and contrast choices. Neither color is a guessed token:\n   an undefined var() would fall back\n   to transparent and white-out the whole button. */\n.mrfw-btnDanger {\n  background: var(--dsw-alias-state-error-primary);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.mrfw-btnDanger:hover:not(:disabled) {\n  background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 85%, var(--dsw-alias-label-primary));\n}\n\n.mrfw-btnOutline {\n  border: 0.5px solid var(--dsw-alias-border-l3);\n  background: transparent;\n}\n\n.mrfw-btnOutline:hover:not(:disabled) {\n  background: var(--dsw-alias-interactive-bg-hover);\n}\n\n.mrfw-btnPrimary {\n  background: var(--dsw-alias-button-primary-fill);\n  color: var(--dsw-alias-label-primary-foreground);\n}\n\n.mrfw-btnPrimary:hover:not(:disabled) {\n  background: var(--dsw-alias-button-primary-hover);\n}\n\n/* One icon-only action: a square of the capsule family, meaning in title.\n   Declared after the .mrfw-btn family so its padding wins the cascade tie:\n   the capsule's 0 10px padding would otherwise squeeze the icon glyph. */\n.mrfw-iconBtn {\n  width: 28px;\n  padding: 0;\n  border-radius: 8px;\n}\n\n.mrfw-input {\n  flex: 1 1 220px;\n  min-width: 0;\n  height: 32px;\n  padding: 0 8px;\n  border: 0.5px solid var(--dsw-alias-border-l4);\n  border-radius: 8px;\n  background: var(--dsw-alias-bg-layer-1);\n  color: var(--dsw-alias-label-primary);\n  font-family: inherit;\n  font-size: 14px;\n  line-height: 22px;\n  outline: none;\n  transition: border-color var(--ds-transition-duration-fast) var(--ds-ease-in-out);\n}\n\n.mrfw-input:focus {\n  border-color: var(--dsw-alias-brand-primary);\n}\n\n.mrfw-input::placeholder {\n  color: var(--dsw-alias-label-dimmed);\n}\n\n.mrfw-inputInline {\n  flex: 1 1 auto;\n}\n\n.mrfw-accessSelect {\n  flex: 0 0 auto;\n}\n\n/* The access dropdown's capsule trigger: the Menu anchor wrapper is the flex\n   item, the button inside keeps the control row's 32px capsule recipe. */\n.mrfw-accessTrigger {\n  padding: 0 12px;\n}\n\n.mrfw-accessBadge,\n.mrfw-effectiveAccess {\n  flex: none;\n  font-size: 12px;\n  line-height: 18px;\n  color: var(--dsw-alias-label-tertiary);\n}\n\n.mrfw-aliasEditor {\n  display: flex;\n  flex-wrap: wrap;\n  gap: 8px;\n  flex-basis: 100%;\n}\n\n.mrfw-actions {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 8px;\n  margin-top: 16px;\n  padding-top: 16px;\n  border-top: 0.5px solid var(--dsw-alias-border-l2);\n}\n\n/* One control row, one height: the capsule buttons match the 32px input. */\n.mrfw-actions .mrfw-btn {\n  height: 32px;\n  border-radius: 16px;\n}\n\n.mrfw-actions .mrfw-iconBtn {\n  width: 32px;\n}\n";

package/lib/types/command.d.ts

@@ -28,6 +28,7 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/command
  */
 import { Context } from '@deepseek-ai/cordis';
+import type { SandboxMode } from '@deepseek-ai/dsh-sandbox';
 import { type RootStatus } from './roots.ts';
 /** Services this row needs before it may activate. */
 export declare const inject: string[];
@@ -36,7 +37,7 @@ export declare const COMMAND_NAME = "workspace-folders";
 /** One parsed command line. */
 export interface FoldersCommand {
     /** The subcommand; `list` when the line named none. */
-    readonly verb: 'list' | 'add' | 'remove' | 'alias' | 'reveal' | 'help';
+    readonly verb: 'list' | 'add' | 'remove' | 'alias' | 'access' | 'reveal' | 'isolate-profiles' | 'help';
     /** Everything after the verb, verbatim (paths may contain spaces). */
     readonly rest: string;
 }
@@ -56,12 +57,18 @@ export declare function parseFoldersCommand(rawInput: string): FoldersCommand;
  * @param unavailable - the store failure, when the registry could not read it.
  * @returns the report text.
  */
-export declare function renderRootsReport(primaryRoot: string, statuses: readonly RootStatus[], unavailable?: string): string;
+export declare function renderRootsReport(primaryRoot: string, statuses: readonly RootStatus[], unavailable?: string, limit?: number, mode?: SandboxMode): string;
+/** The command-row config: the canonical DSH home `isolate-profiles` inspects. */
+export interface CommandConfig {
+    /** `$DSH_HOME` as the host resolved it — an absolute path, or the verb fails. */
+    readonly dshHome?: string;
+}
 /**
  * Register the command and, where a host Connection exists, the panel channel.
  * @param ctx - the host context carrying `commands`, `sandboxPolicy`, and the registry.
+ * @param config - the row's config; `dshHome` feeds `isolate-profiles` only.
  */
-export declare function apply(ctx: Context): void;
+export declare function apply(ctx: Context, config?: CommandConfig): void;
 /**
  * Derive the primary root a panel request may act on.
  *
@@ -81,3 +88,9 @@ export declare function apply(ctx: Context): void;
 export declare function resolvePanelPrimaryRoot(ctx: Context, sessionId: string): string;
 /** The per-platform argv that reveals one directory in the OS file manager. */
 export declare function revealArgv(platform: NodeJS.Platform, path: string): readonly string[];
+/**
+ * Whether the file manager's exit code means the reveal was accepted.
+ * `explorer.exe` answers 1 even when it successfully selected the item, so on
+ * Windows both 0 and 1 are success; the other managers honor the usual 0.
+ */
+export declare function revealAccepted(platform: NodeJS.Platform, exitCode: number | null): boolean;

package/lib/types/compat/client-icons.d.ts

@@ -28,6 +28,19 @@ type IconModule = Readonly<Record<string, PanelIcon | undefined>>;
  *   break to adapt here, not a missing optional peer.
  */
 export declare function selectIcon(module: IconModule, names: readonly string[]): PanelIcon;
+/**
+ * The same by-name probe for a decorative glyph a release may simply not
+ * carry: absence degrades to no icon, not to a boot error. Required icons go
+ * through `selectIcon` and fail loud; optional ones go through here.
+ */
+export declare function maybeIcon(names: readonly string[]): PanelIcon | undefined;
+/**
+ * The same by-name probe for a whole component a release may not carry:
+ * `PathLabel` arrived in `0.1.7-alpha.1`, so pixel-era runtimes degrade to a
+ * plain span where the header invites one. Absence degrades to no component,
+ * not to a boot error.
+ */
+export declare function maybeComponent<T>(names: readonly string[]): T | undefined;
 export declare const IconChevronDown: PanelIcon;
 export declare const IconChevronUp: PanelIcon;
 export declare const IconCopy: PanelIcon;
@@ -36,5 +49,10 @@ export declare const IconEllipsis: PanelIcon;
 export declare const IconFolderClose: PanelIcon;
 export declare const IconFolderOpen: PanelIcon;
 export declare const IconPlus: PanelIcon;
+export declare const IconRefresh: PanelIcon;
+export declare const IconSettings: PanelIcon;
 export declare const IconTrash: PanelIcon;
+export declare const IconAccessReadWrite: PanelIcon | undefined;
+export declare const IconAccessReadOnly: PanelIcon | undefined;
+export declare const IconAccessInherit: PanelIcon | undefined;
 export {};

package/lib/types/compat/dsh-version.d.ts

@@ -28,7 +28,7 @@
  * the upgrade smoke passed on that exact version — a green CI run on an
  * unlisted release is evidence, not authorization (ADR-0009).
  */
-export declare const SUPPORTED_DSH_RELEASES: readonly ["0.1.5-rc.2", "0.1.6-alpha.1", "0.1.6-alpha.2", "0.1.7-alpha.1", "0.1.7-alpha.2", "0.1.7-rc.1", "0.1.7-rc.2", "0.2.0-rc.1", "0.2.0-rc.2", "0.2.1-alpha.1", "0.2.1-alpha.2"];
+export declare const SUPPORTED_DSH_RELEASES: readonly ["0.1.5-rc.2", "0.1.6-alpha.1", "0.1.6-alpha.2", "0.1.7-alpha.1", "0.1.7-alpha.2", "0.1.7-rc.1", "0.1.7-rc.2", "0.2.0-rc.1", "0.2.0-rc.2", "0.2.1-alpha.1", "0.2.1-alpha.2", "0.2.1-alpha.3", "0.2.1-alpha.4", "0.2.1-alpha.5", "0.2.1-rc.1", "0.2.1-rc.2"];
 /** One release this plugin claims to support. */
 export type SupportedDshRelease = typeof SUPPORTED_DSH_RELEASES[number];
 /**

package/lib/types/compat/open-in-app-routes.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Compatibility adapter for the route constants of
+ * `@deepseek-ai/dsh-host-open-in-app/shared`.
+ *
+ * ```text
+ * 0.1.5-rc.2 / 0.1.6   OPEN_IN_APP_ICON_PREFIX = '/open-in-app/icon'       (absolute pathname)
+ * 0.1.7-alpha.1 +      OPEN_IN_APP_ICON_PREFIX_ROUTE = 'open-in-app/icon'  (document-relative)
+ * ```
+ *
+ * `0.1.7-alpha.1` split every shared route constant into a `*_PATH` spelling
+ * the Host registers and a `*_ROUTE` spelling the browser addresses, retiring
+ * the old names. The fork's `iconUrl` needs the browser-facing form — which a
+ * pixel-era release spells without the `_ROUTE` suffix, so a named import of
+ * the new name does not even BUILD against those manifests (MISSING_EXPORT at
+ * bundle time, not a runtime undefined). The lookup is by export name, not by
+ * release string.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/open-in-app-routes
+ */
+/** Exports addressed by name. A release spells each route exactly one way. */
+type SharedModule = Readonly<Record<string, string | undefined>>;
+/**
+ * Pick the first export name this release actually provides.
+ * @param module - the shared module to read.
+ * @param names - candidate export names, preferred first.
+ * @returns the route string.
+ * @throws {Error} when none of the names is exported. That is a compatibility
+ *   break to adapt here, not a missing optional peer.
+ */
+export declare function selectSharedRoute(module: SharedModule, names: readonly string[]): string;
+/**
+ * The browser-facing icon-prefix route, whichever spelling this release
+ * exports. Resolved once at module load: the fork's adapter only reaches
+ * `iconUrl` on runtimes whose glyph gate already passed, and on the pixel era
+ * the absolute form is exactly what upstream's own client fetched.
+ */
+export declare const OPEN_IN_APP_ICON_URL_PREFIX: string;
+export {};

package/lib/types/compat/process-entrypoints.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Compatibility adapter: which public executor entries the mounted process
+ * services expose.
+ *
+ * The process fence (`src/process-fence.ts`) wraps the entries through which
+ * a `danger-full-access` call can spawn an ambient subprocess. Which of them
+ * exist is a per-release shape — `execute` is the shell executor's only entry
+ * on current releases while `start` existed through 0.1.6, and the PTC
+ * runtime's public seam is `run` (its `execute` helper is private to the
+ * concrete runtime and is deliberately never a cross-package seam). The fence
+ * therefore asks this module, structurally, which entries the MOUNTED service
+ * actually carries — never a version string.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/process-entrypoints
+ */
+/** A public shell/executor entry the process fence can wrap. */
+export type ProcessEntrypoint = 'execute' | 'run' | 'start';
+/**
+ * The public shell executor entries present on the mounted service, in this
+ * order: `execute`, `run`, `start` (`start` existed through 0.1.6).
+ * @param shell - the mounted `ctx.shell` service.
+ * @returns the present entries — a structural probe only.
+ */
+export declare function shellEntrypoints(shell: object): readonly ProcessEntrypoint[];
+/**
+ * The PTC runtime's public entry: `['run']` when it is a function; never the
+ * concrete runtime's private `execute` helper.
+ * @param runtime - the mounted `ctx.ptcRuntime` service.
+ * @returns the present entries — a structural probe only.
+ */
+export declare function ptcEntrypoints(runtime: object): readonly ProcessEntrypoint[];

package/lib/types/compat/process-result.d.ts

@@ -0,0 +1,14 @@
+/** Structural adaptation of settled shell executions and PTC results. Keeps
+ * the execution identity, cached result, and installed sync/async shape.
+ */
+import type { ConfinedArgv, SandboxExecutionPolicy } from '@deepseek-ai/dsh-sandbox';
+/** Diagnostics a caller can supply for outcomes that carry no stderr of their
+ * own — a non-consuming `collected.stderr.readFrom(0)` tail on the subprocess
+ * the confined call spawned, read at settle the way the executor's own
+ * `onProcessDone` seam does.
+ */
+export interface SettledOutcomeDiagnostics {
+    readonly stderr?: (() => string | undefined) | undefined;
+}
+export declare function stampProcessResult(value: unknown, facts: ConfinedArgv, policy: SandboxExecutionPolicy): unknown;
+export declare function decorateProcessOutcome(value: unknown, facts: ConfinedArgv, policy: SandboxExecutionPolicy, diagnostics?: SettledOutcomeDiagnostics): unknown;

package/lib/types/compat/pty-marker.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Boot-time probe for the agent-PTY marker contract.
+ *
+ * `multi-root-process-fence` tells an agent terminal from the user's own by
+ * one env fact: every supported `dsh-terminal-bash` backend stamps
+ * `DSH_PTY_SESSION_ID` (alongside `DSH_SESSION_ID`) into the PTY spawn spec,
+ * while the panel's terminal controller stamps only `DSH_SESSION_ID`. That
+ * marker is the ONLY discriminator — a backend that ever stops stamping it
+ * would reclassify agent PTYs as user terminals and pass them through
+ * unconfined under a restricted `danger-full-access`, which is a silent
+ * fail-open on a security boundary.
+ *
+ * The marker is an env key inside upstream's emitted code, not an exported
+ * symbol, so the honest structural probe is content: the installed backend
+ * package must still write the marker. This module is called from the
+ * `multi-root-compat` gate (`src/compat.ts`) BEFORE the service registers —
+ * like the version verdict it is a precondition, not a diagnostic, and a
+ * breach refuses the composition the same way `mixed`/`incomplete` do: it is
+ * not relaxable by `DSH_MULTI_ROOT_COMPAT=warn`.
+ *
+ * Resolution follows the optional-peer precedent (`agent-instructions.ts`):
+ * the backend is not a peer of this plugin, so the plugin anchor is tried
+ * first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
+ * same `HOST_RESOLVED_PACKAGES` pattern as `dsh-version.ts` — because the
+ * backend rides inside the harness meta package's own dependency tree.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
+ */
+/** The env key that identifies an agent-launched PTY spawn spec. */
+export declare const AGENT_PTY_MARKER = "DSH_PTY_SESSION_ID";
+/**
+ * What the probe established about the installed backend.
+ *
+ * - `stamped` — the marker assignment is present in the installed code.
+ * - `uninstalled` — no `dsh-terminal-bash` resolves; an installation without
+ *   the backend can never launch an agent PTY, so the contract holds vacuously.
+ * - `unverifiable` — the package resolves but the marker cannot be confirmed:
+ *   absent from the emitted code, or the code cannot be read. Either way the
+ *   fence's agent/user split is unproven, and the gate must refuse rather
+ *   than guess — "cannot verify" is not "nothing is stamped".
+ */
+export type AgentPtyMarkerVerdict = 'stamped' | 'uninstalled' | 'unverifiable';
+/**
+ * Raised when the installed terminal backend does not uphold the marker
+ * contract. Thrown from `apply` like `DshCompatUnsupportedError`, so it
+ * surfaces as a plugin load failure with the diagnosis attached.
+ */
+export declare class PtyMarkerContractError extends Error {
+    /** The resolved backend path when one was found. */
+    readonly backend: string | undefined;
+    constructor(message: string, backend?: string);
+}
+/** The filesystem seams the probe needs — injectable so tests stay pure. */
+export interface AgentPtyMarkerIo {
+    /**
+     * Resolve the backend package's install root, or `undefined` when it is not
+     * installed anywhere the contract can see. A resolution failure that is not
+     * "module not found" must THROW — the package may exist and be malformed,
+     * which is `unverifiable`, not `uninstalled`.
+     */
+    resolveBackendRoot(): string | undefined;
+    /** Every emitted `.js` file under the package root, bounded by the caps. */
+    listSources(root: string): string[];
+    /** One file's contents; throws when the file cannot be read. */
+    read(path: string): string;
+}
+/**
+ * Judge the installed terminal backend against the marker contract.
+ *
+ * Never throws: every outcome — absent package, unreadable source, missing
+ * marker — is folded into the verdict so the caller's reaction is a policy
+ * decision in one place.
+ * @param io - filesystem seams; tests inject them, production uses real fs.
+ * @returns the verdict.
+ */
+export declare function agentPtyMarkerVerdict(io?: AgentPtyMarkerIo): AgentPtyMarkerVerdict;
+/**
+ * Enforce the contract: refuse when the marker cannot be confirmed.
+ *
+ * @param io - filesystem seams; tests inject them.
+ * @throws {PtyMarkerContractError} on `unverifiable`.
+ */
+export declare function assertAgentPtyMarker(io?: AgentPtyMarkerIo): void;

package/lib/types/compat/sandbox-confine.d.ts

@@ -43,6 +43,8 @@ export type UpstreamConfined = ReturnType<LocalSandboxProvider['confine']>;
  * cancellation support simply never observes it.
  */
 export type ConfineCall = (argv: readonly string[], policy: SandboxPolicy, signal?: AbortSignal) => ConfinedArgv | Promise<ConfinedArgv>;
+/** Map an installed confine result without changing its synchronous shape. */
+export declare function mapConfined<T>(value: UpstreamConfined, map: (confined: ConfinedArgv) => T): T | Promise<T>;
 /**
  * Call the upstream `confine` and widen its result, preserving sync/async shape.
  *

package/lib/types/compat/storage-zod.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Build the domain record schemas with the zod module the installed
+ * `@deepseek-ai/dsh-storage-domain` resolves.
+ *
+ * ```text
+ * through 0.2.1-alpha.2   storage-domain declares zod ^4.4.3
+ * from   0.2.1-alpha.3    storage-domain declares zod 4.4.3 exactly
+ * ```
+ *
+ * `domainTable` types its `schema` parameter as `ZodType`, resolved from
+ * whichever zod copy storage-domain itself depends on — never from the copy
+ * this package installs for its own validation work (`src/contract.ts`
+ * parses the panel wire shapes with it). While upstream declared `^4.4.3`,
+ * both sides resolved to one install; the exact `4.4.3` pin since
+ * `0.2.1-alpha.3` splits the tree into two resolutions of the same v4 line,
+ * and zod v4 brands every type with the minor it was compiled by, so a
+ * schema produced by `4.6.x` is not assignable to a `ZodType` declared by
+ * `4.4.3`. Pinning this package to `4.4.3` would only move the split to the
+ * other side: on the supported releases before the pin changed, upstream's
+ * `^4.4.3` resolves to `4.6.x` and the pinned copy is the foreign one.
+ *
+ * The fix resolves the BUILDER the same way the boundary resolves the TYPE:
+ * `require('zod')` from inside the storage-domain package. A schema built by
+ * that namespace is by construction an instance of the `ZodType` the
+ * installed `domainTable` accepts, on every supported release — whichever
+ * zod version a release pins, both sides keep coming from one module.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/storage-zod
+ */
+import type { DomainTableSpec } from '@deepseek-ai/dsh-storage-domain';
+/**
+ * The `ZodType` the installed `domainTable` accepts for records of `V`.
+ * Indexed off `DomainTableSpec` rather than named `zod`: the specifier would
+ * resolve THIS package's zod copy, which is exactly the split this module
+ * exists to avoid.
+ */
+export type DomainValueSchema<V> = DomainTableSpec<string, V>['valueSchema'];
+/**
+ * The slice of the zod namespace the domain schemas are built from.
+ * Structurally typed — `typeof import('zod')` would brand every product with
+ * this package's copy — and products stay `unknown`-shaped; the
+ * {@link DomainValueSchema} annotation on the schema declaration is what
+ * binds them to the boundary type.
+ */
+interface DomainZodModule {
+    object(shape: Record<string, unknown>): any;
+    string(): {
+        min(length: number): any;
+        optional(): any;
+    };
+    array(item: unknown): any;
+}
+/**
+ * The `z` namespace as the installed `@deepseek-ai/dsh-storage-domain`
+ * resolves it.
+ *
+ * A resolution failure propagates rather than falling back to this package's
+ * zod: a storage-domain that no longer depends on zod changes what
+ * `domainTable` accepts, and that is an adapter decision, not a silent
+ * degradation. The failure surfaces where a missing peer already would — at
+ * module load, before any row runs.
+ * @returns the zod module, typed as the used surface only.
+ */
+export declare function domainZod(): DomainZodModule;
+export {};

package/lib/types/compat/windows-deny-preflight.d.ts

@@ -0,0 +1,21 @@
+import type { WindowsPathIdentity } from './windows-path-guard.ts';
+import type { NativeApi, NativePointer, WindowsNative } from './windows-native.ts';
+export interface DenyPreflightEntry {
+    /** The deny root (canonical spelling) this entry was scanned under. */
+    readonly root: string;
+    /** The entry's full path spelling as walked — the key lowercased. */
+    readonly path: string;
+    readonly identity: WindowsPathIdentity;
+}
+export interface WindowsDenyPreflight {
+    /** Every scanned node in depth-first insertion order, keyed `path.toLowerCase()`. */
+    readonly entries: ReadonlyMap<string, DenyPreflightEntry>;
+    /** Refuse if the live handle's identity differs from the snapshot. */
+    verifyHandle(api: NativeApi, path: string, handle: NativePointer): void;
+}
+/**
+ * Scan every root recursively. The returned snapshot keys every node by its
+ * lowercased walked spelling; a later same-key path (shared subtree) keeps
+ * the first entry and is not re-scanned.
+ */
+export declare function preflightWindowsDenyRoots(native: WindowsNative, roots: readonly string[], protectedHome?: string): WindowsDenyPreflight;

package/lib/types/compat/windows-native.d.ts

@@ -0,0 +1,68 @@
+export type NativePointer = unknown;
+export type NativeFunction = (...args: readonly unknown[]) => number;
+export interface NativeApi {
+    [name: string]: NativeFunction;
+}
+export interface KoffiApi {
+    decode(pointer: NativePointer, type: string, length?: number): unknown;
+    address(pointer: NativePointer): bigint;
+    load(name: string): unknown;
+    alloc(type: string, length: number): NativePointer;
+    free(pointer: NativePointer): void;
+    encode(pointer: NativePointer, type: string, value: unknown, length?: number): void;
+}
+export interface WindowsNative {
+    koffi: KoffiApi;
+    extendWin32ProcessBindings(create: (context: {
+        kernel32: unknown;
+        advapi32: unknown;
+        bind(library: unknown, name: string, result: string, args: string[]): unknown;
+    }) => NativeApi): NativeApi;
+    spawnInheritedJobProcess(api: NativeApi, options: {
+        token: NativePointer;
+        command: string;
+        args: readonly string[];
+        cwd: string;
+        controlFileDescriptor?: 7;
+    }): {
+        process: NativePointer;
+        job: NativePointer;
+    };
+    waitForProcessExit(api: NativeApi, process: NativePointer): number;
+}
+/** Decode the UTF-16 pointee, not a second string pointer stored at its first
+ * code units. `decode(ptr, 'str16')` would dereference those units as an address.
+ */
+export declare function readWindowsWideString(koffi: KoffiApi, pointer: NativePointer): string;
+export declare function loadWindowsNative(upstreamRunner: string): Promise<WindowsNative>;
+/** Older public process helpers predate fd-7 CRT forwarding. Adapt the Win32
+ * STARTUPINFO structure at the public binding seam, preserving argv and Job
+ * ownership. New helpers already populate cbReserved2 and pass through.
+ */
+export declare function spawnWindowsDeniedChild(native: WindowsNative, api: NativeApi, options: Parameters<WindowsNative['spawnInheritedJobProcess']>[1], activation?: {
+    sourceToken: NativePointer;
+    assign(process: NativePointer, thread: NativePointer): void;
+}): ReturnType<WindowsNative['spawnInheritedJobProcess']>;
+/**
+ * Terminate a kill-on-close Job and wait until the kernel reports it drained.
+ *
+ * The public `waitForProcessExit` covers the direct child only: a descendant
+ * the child spawned before exiting stays in the Job and could otherwise keep
+ * running — with its restricted token — after the runner has released its
+ * ancestor pins. `TerminateJobObject(job, 127)` kills every member; the
+ * subsequent `QueryInformationJobObject` polling loop (class 1,
+ * JOBOBJECT_BASIC_ACCOUNTING_INFORMATION, `ActiveProcesses` at byte 40) only
+ * returns once the kernel reports none left. There is deliberately no
+ * timeout: releasing pins while a live descendant remains is exactly the gap
+ * this wait exists to close. The caller still owns and closes the Job handle
+ * afterwards.
+ *
+ * Abnormal-error boundary: a TerminateJobObject or QueryInformationJobObject
+ * API failure throws into the caller's teardown — the Job handle is still
+ * closed there and its kill-on-close flag is the residual bound, same as the
+ * forced-termination case: if the runner process itself is killed, no
+ * in-process guarantee can survive, the Job flag takes the descendants down
+ * with it, and the pin handles die with the process. Protection is promised
+ * only through this orderly path.
+ */
+export declare function terminateWindowsJobAndWait(native: WindowsNative, api: NativeApi, job: NativePointer): void;

package/lib/types/compat/windows-path-guard.d.ts

@@ -0,0 +1,56 @@
+/** Windows deny-path pinning (branch-review Phase B).
+ *
+ * The ACL writer's deny ACEs follow the file OBJECT, not the registered
+ * spelling: a restricted process that renames a deny root's ancestor moves
+ * the protected tree to a NEW path the recorded deny set does not name — the
+ * kernel still refuses that token's writes through the moved ACEs, but the
+ * host fs fence, which matches the recorded spellings, no longer covers the
+ * moved objects (the shell → host new-path gap, R1). This guard pins every
+ * ancestor directory of every deny root with an open handle that shares read
+ * and write but NOT delete — so a rename or delete of the registered tree
+ * fails for the lifetime of the restricted child, without writing a single
+ * persistent ACL on `C:\`, user directories, or anywhere else.
+ *
+ * `windows-deny.ts` owns the lifetime contract: handles are held until the
+ * confined child AND its drained Job descendants have exited.
+ *
+ * Primitives are bound through the public `extendWin32ProcessBindings` seam —
+ * no upstream private file, no new native dependency. Every verification uses
+ * the same handle that pins the directory, so the checked object and the
+ * pinned object are always the same one.
+ */
+import type { NativeApi, NativePointer, WindowsNative } from './windows-native.ts';
+/** What `GetFileInformationByHandle` reports for one pinned object. */
+export interface WindowsPathIdentity {
+    readonly attributes: number;
+    readonly volumeSerial: number;
+    readonly fileIndex: bigint;
+    readonly links: number;
+}
+/** Held ancestor pins. {@link WindowsPathGuard.close} releases every handle. */
+export interface WindowsPathGuard {
+    close(): void;
+}
+/** BY_HANDLE_FILE_INFORMATION is 52 bytes (FILETIME members are DWORD-pairs):
+ * attributes @0, volume serial @28, link count @40, file index high @44 /
+ * low @48. Read back on the same handle that pins the path, so the identity
+ * cannot drift between check and pin.
+ */
+export declare function readWindowsPathIdentity(api: NativeApi, handle: NativePointer): WindowsPathIdentity;
+/**
+ * Open a pin handle on every ancestor of every deny root — including the deny
+ * root itself — and hold them all until {@link WindowsPathGuard.close}. Each
+ * handle is opened with GENERIC_READ, read+write sharing, and a null security
+ * descriptor so it is non-inheritable; the missing DELETE sharing is what
+ * blocks renames, while ordinary reads and writes (and creating sibling files
+ * inside a pinned directory) keep working.
+ *
+ * Every pin is verified on the same handle: the object must be a directory,
+ * must not be a reparse point, must not carry the inherit flag (so a confined
+ * child cannot simply `CloseHandle` the pin away), and its kernel-reported
+ * final DOS path must equal the expected canonical spelling.
+ * Any failure — open, verification, or a sharing conflict with a handle some
+ * other component already holds — closes every earlier pin in reverse order
+ * and refuses, keeping the launch fail-closed before spawn.
+ */
+export declare function pinWindowsDenyPaths(native: WindowsNative, roots: readonly string[]): WindowsPathGuard;

package/lib/types/compat/workspace-files.d.ts

@@ -2,4 +2,6 @@
 import type { WorkspaceFiles, WorkspaceFileScope, WorkspaceFileWatchFrame } from '@deepseek-ai/dsh-api-workspace-files';
 type PathWatch = (this: WorkspaceFiles, scope: WorkspaceFileScope, path: string, signal: AbortSignal) => AsyncIterable<WorkspaceFileWatchFrame>;
 export declare function adaptPathWatch(service: WorkspaceFiles, wrap: (original: PathWatch) => PathWatch): () => void;
+/** Match both legacy `readRelated` and modern `readBytes({ baseFile })` tail resolution. */
+export declare function resolveRelatedWorkspacePath(absoluteBase: string, tail: string): string;
 export {};