@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.8

package/lib/sandbox.js

@@ -1,2 +1,3 @@
-import { t as MultiRootSandboxProvider } from "./sandbox-BRXl_FpF.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-CVAcT_gy.js";
+import "./providers.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,6 +1,10 @@
+import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
+import { r as effectiveRootAccess } from "./contract-DZ4zczDT.js";
 import { Service } from "@deepseek-ai/cordis";
-import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { statSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 //#region src/scope.ts
 /**
 * The multi-root workspace scope: the plugin's single home for the question
@@ -38,9 +42,14 @@ import { statSync } from "node:fs";
 * @returns the sanitized additional roots.
 */
 function sanitizeAdditionalRoots(primaryRoot, roots) {
+	return sanitizeMembers(primaryRoot, roots).map((root) => root.path);
+}
+/** The member-level form of {@link sanitizeAdditionalRoots}: same rules, with access kept. */
+function sanitizeMembers(primaryRoot, roots) {
 	const seen = /* @__PURE__ */ new Set([primaryRoot]);
 	const result = [];
 	for (const root of roots) {
+		if (root.withheld) continue;
 		const recorded = root.recordedPath;
 		if (typeof recorded !== "string" || recorded === "") continue;
 		const canonical = canonicalPath(root.path);
@@ -52,7 +61,12 @@ function sanitizeAdditionalRoots(primaryRoot, roots) {
 		}
 		if (seen.has(canonical)) continue;
 		seen.add(canonical);
-		result.push(canonical);
+		result.push({
+			path: canonical,
+			access: root.access,
+			id: root.id,
+			...root.alias === void 0 ? {} : { alias: root.alias }
+		});
 	}
 	return result;
 }
@@ -62,18 +76,75 @@ function sanitizeAdditionalRoots(primaryRoot, roots) {
 */
 const MULTI_ROOT_CONTEXT_NAME = "multi-root:scope";
 /**
-* Render the workspace topology the model is told about. Only roots are listed
-* (never files), and the sentence states the two facts a denied write would
-* otherwise have to teach: that the additional roots are part of the SAME
-* workspace, and that the session cwd is unchanged (requirement §5, §8).
-* @param primaryRoot - the canonical session workspace root.
-* @param additionalRoots - canonical additional roots, in scope order.
-* @returns the stable topology sentence.
+* The deterministic sentence the model hears while the registry authority is
+* unavailable under either writable mode — enforcement is then the
+* primary-root-only one, which the prompt must not leave implicit.
+*/
+const REGISTRY_UNAVAILABLE_NOTE = "The DSH multi-root registry is not available in this process, so writes are temporarily limited to the primary root; shared platform temp directories are not writable. Explicit deny boundaries still take precedence.";
+/**
+* The B9 effective-access rule (ADR-0017's nine-cell matrix): whether a root
+* with this registration policy is writable under this session mode.
+* `read-write` is writable everywhere; `inherit` follows the mode;
+* `read-only` never is.
 */
-function renderWorkspaceRootsContext(primaryRoot, additionalRoots) {
-	return `Current DSH workspace roots: ${JSON.stringify(additionalRoots)} are additional roots of this session's workspace. Under workspace-write they may be modified like the session workspace; the session origin remains the primary root (${JSON.stringify(primaryRoot)}); changing the working directory does not change these grants.`;
+function effectivelyWritable(mode, access) {
+	return effectiveRootAccess(access, mode) !== "read-only";
 }
 /**
+* Render the workspace topology the model is told about. Pure: the text
+* depends only on its inputs, so two consecutive assemblies of the same
+* session state produce the same contribution byte for byte. Only granted
+* members are ever listed — withheld, missing, or invalid roots never reach
+* `roots` in the first place — and no host internals (ids, SIDs, store or
+* lease paths) are ever named.
+* @param options.platform - the host platform (`process.platform` of the contribution).
+* @param options.mode - the session's sandbox mode.
+* @param options.primaryRoot - the canonical session workspace root.
+* @param options.roots - the granted additional members, in registry order.
+* @param options.cappedTools - sorted tool names that can never write an additional root.
+* @param options.toolAccessInvalid - invalid host config caps every additional-root write.
+* @param options.authority - the registry-authority fact; `unavailable` under
+*   `danger-full-access` and `workspace-write` limit writes to the primary root, which the
+*   model must hear even when there is no topology to describe.
+* @param options.protectedHome - the canonical DSH home when the scope appended
+*   it to the deny set (`danger-full-access` with restrictions); stated by path
+*   so the model can place the refusal.
+* @returns the stable topology text; empty when there are no additional roots
+*   and no downgrade to report.
+*/
+function renderWorkspaceRootsContext(options) {
+	const { platform, mode, primaryRoot, roots, cappedTools } = options;
+	const lead = [options.authority === "unavailable" && mode !== "read-only" ? REGISTRY_UNAVAILABLE_NOTE : "", options.protectedHome !== void 0 && mode === "danger-full-access" ? `Writes under the DSH home directory at ${JSON.stringify(options.protectedHome)} are refused.` : ""].filter((note) => note !== "").join(" ");
+	if (options.authority === "unavailable") return lead;
+	if (roots.length === 0) return lead;
+	const prefix = lead === "" ? "" : `${lead} `;
+	const members = JSON.stringify(roots.map((root) => root.path));
+	const readOnly = roots.filter((root) => root.access === "read-only").map((root) => root.path);
+	const capNote = cappedTools.length === 0 ? "" : ` The tools ${JSON.stringify(cappedTools)} cannot write additional roots even where they are writable.`;
+	if (mode === "read-only") {
+		const writable = options.toolAccessInvalid ? [] : roots.filter((root) => root.access === "read-write").map((root) => root.path);
+		if (writable.length === 0) return prefix + `Current DSH workspace roots: ${members} are additional roots of this session's workspace and are readable; nothing is writable in read-only mode.` + capNote;
+		const readable = roots.filter((root) => root.access !== "read-write").map((root) => root.path);
+		let text = `Current DSH workspace roots: ${JSON.stringify(writable)} are additional roots that stay writable even in read-only mode`;
+		if (readable.length > 0) text += `, and ${JSON.stringify(readable)} are readable additional roots`;
+		return prefix + text + " of this session's workspace; everything else is read-only." + capNote;
+	}
+	if (mode === "danger-full-access") {
+		const refused = options.toolAccessInvalid ? roots.map((root) => root.path) : readOnly;
+		return prefix + `Current DSH workspace roots: ${members} are additional roots of this session's workspace; danger-full-access mode has no sandbox isolation` + (refused.length > 0 ? `, except writes under the additional roots ${JSON.stringify(refused)} are still refused${options.toolAccessInvalid === true ? " because toolAccess is invalid" : ""}. Grant changes apply to later operations and newly started processes, not to processes already running.` : ".") + capNote;
+	}
+	const writable = options.toolAccessInvalid ? [] : roots.filter((root) => root.access !== "read-only").map((root) => root.path);
+	const groups = [];
+	if (options.toolAccessInvalid) groups.push(`${members} are readable additional roots (all additional-root writes are refused because toolAccess is invalid)`);
+	if (writable.length > 0) groups.push(`${JSON.stringify(writable)} are writable additional roots`);
+	if (!options.toolAccessInvalid && readOnly.length > 0) groups.push(`${JSON.stringify(readOnly)} are read-only additional roots (writes are refused)`);
+	let text = `Current DSH workspace roots: ${groups.join(" and ")} of this session's workspace. The session origin remains the primary root (${JSON.stringify(primaryRoot)}); changing the working directory does not change these grants. Grant changes apply to later operations and newly started processes, not to processes already running.`;
+	if (platform === "win32" && !options.toolAccessInvalid) text += " Writable additional roots are enforced for shell processes by the upstream Windows ACL restricted-token sandbox, whose enforcement is reported as partial; reads are not confined by it.";
+	return prefix + text + capNote;
+}
+/** The tool-dispatch cap carried across async boundaries by the waterfall. */
+const toolCapStore = new AsyncLocalStorage();
+/**
 * The `ctx.multiRootScope` service. Providers ask it — never the filesystem —
 * what the current scope is, which is what keeps the fs fence and every kernel
 * dialect on one permission world (requirement §13).
@@ -82,6 +153,26 @@ var MultiRootScopeService = class extends Service {
 	/** Additional roots keyed by canonical primary root; empty until roots are registered. */
 	rootsByPrimary = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
+	/**
+	* The registry-authority fact the registry row publishes. Defaults to
+	* `available`: a composition without a registry row can never have
+	* registered roots, so nothing is unknown there. The registry sets it false
+	* the moment it cannot prove the store is its own — before the lease is
+	* acquired, while contended or storage-failed, and at teardown — and true
+	* only after the accepted records have been published.
+	*/
+	registryAuthority = "available";
+	/** Validated `toolAccess` row config; empty when no tool is capped. */
+	caps;
+	/** A malformed `toolAccess` refuses every additional-root write (fail closed). */
+	capsInvalid;
+	/**
+	* The configured DSH home boundary; `undefined` when the row carries no
+	* `dshHome` (bare test compositions) or one that is not an absolute string —
+	* an invalid value is logged at construction and ignored rather than
+	* treated as evidence.
+	*/
+	dshHome;
 	/** Observe registry publications; consumers still resolve authority from scopeOf(). */
 	subscribe(listener) {
 		this.listeners.add(listener);
@@ -89,8 +180,39 @@ var MultiRootScopeService = class extends Service {
 			this.listeners.delete(listener);
 		};
 	}
-	constructor(ctx) {
+	/**
+	* The sorted names of the tools `toolAccess` caps — read-only for the
+	* prompt contribution. An invalid config is not enumerated (it caps every
+	* call but is not a listable tool set).
+	*/
+	toolCaps() {
+		return Object.keys(this.caps).sort();
+	}
+	/** Whether malformed toolAccess caps every call, including unknown tools. */
+	get toolAccessInvalid() {
+		return this.capsInvalid;
+	}
+	constructor(ctx, config = {}) {
 		super(ctx, "multiRootScope");
+		const toolAccess = config.toolAccess;
+		if (toolAccess === void 0) {
+			this.caps = {};
+			this.capsInvalid = false;
+		} else if (typeof toolAccess !== "object" || toolAccess === null || Array.isArray(toolAccess) || Object.values(toolAccess).some((value) => value !== "read-only")) {
+			this.caps = {};
+			this.capsInvalid = true;
+			ctx.logger.error(`multi-root-workspace: invalid toolAccess config (expected an object mapping tool names to "read-only", got ${JSON.stringify(toolAccess)}); no additional root is writable`);
+		} else {
+			this.caps = { ...toolAccess };
+			this.capsInvalid = false;
+		}
+		const dshHome = config.dshHome;
+		if (dshHome !== void 0 && (typeof dshHome !== "string" || dshHome.trim() === "" || !isAbsolute(dshHome))) ctx.logger.error(`multi-root-workspace: invalid dshHome config (expected an absolute path, got ${JSON.stringify(dshHome)}); the DSH-home deny boundary is disabled`);
+		else this.dshHome = dshHome;
+		aroundTool(ctx, (exec, next) => {
+			const parent = toolCapStore.getStore();
+			return toolCapStore.run({ capped: parent?.capped === true || this.caps[exec.name] === "read-only" }, next);
+		});
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
 			scope.systemPrompt.context({
 				name: MULTI_ROOT_CONTEXT_NAME,
@@ -99,10 +221,18 @@ var MultiRootScopeService = class extends Service {
 					const session = assembly.agent?.session;
 					if (session === void 0) return "";
 					const policy = scope.sandboxPolicy.resolve({ session });
-					if (policy.mode !== "workspace-write") return "";
 					const resolved = this.resolve(policy);
-					if (resolved.additionalRoots.length === 0) return "";
-					return renderWorkspaceRootsContext(resolved.primaryRoot, resolved.additionalRoots);
+					if (resolved.roots.length === 0 && resolved.authority !== "unavailable" && resolved.protectedHome === void 0) return "";
+					return renderWorkspaceRootsContext({
+						platform: process.platform,
+						mode: policy.mode,
+						primaryRoot: resolved.primaryRoot,
+						roots: resolved.roots,
+						cappedTools: this.toolCaps(),
+						toolAccessInvalid: this.toolAccessInvalid,
+						authority: resolved.authority,
+						...resolved.protectedHome === void 0 ? {} : { protectedHome: resolved.protectedHome }
+					});
 				}
 			});
 		});
@@ -114,20 +244,86 @@ var MultiRootScopeService = class extends Service {
 	*/
 	resolve(policy) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
+		const roots = this.membersOf(primaryRoot);
+		const capped = this.capped();
+		const writable = capped || this.registryAuthority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
+		const denied = (this.rootsByPrimary.get(primaryRoot) ?? []).filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
+		const deniedRoots = [...new Set(denied)];
+		let protectedHome;
+		if (this.dshHome !== void 0 && policy.mode === "danger-full-access" && (deniedRoots.length > 0 || this.registryAuthority === "unavailable")) {
+			const home = canonicalPath(this.dshHome);
+			if (!deniedRoots.includes(home)) {
+				deniedRoots.push(home);
+				protectedHome = home;
+			}
+		}
 		return {
 			primaryRoot,
-			additionalRoots: this.scopeOf(primaryRoot)
+			additionalRoots: roots.map((root) => root.path),
+			roots,
+			writableRoots: writable,
+			deniedRoots,
+			authority: this.registryAuthority,
+			...protectedHome === void 0 ? {} : { protectedHome }
 		};
 	}
 	/**
-	* The additional roots registered for one canonical primary root.
+	* Whether THIS call's additional-root writes are capped. Inside a tool
+	* dispatch the AsyncLocalStorage store answers; outside any dispatch (user
+	* PTY, panel, an unknown async boundary) the answer is fail-closed: capped
+	* whenever `toolAccess` names any tool, because an operation whose tool
+	* identity is unknown gets the most restrictive configured cap. Membership
+	* is never affected — only writability.
+	*/
+	capped() {
+		if (this.capsInvalid) return true;
+		const store = toolCapStore.getStore();
+		if (store !== void 0) return store.capped;
+		return Object.keys(this.caps).length > 0;
+	}
+	/**
+	* The additional roots registered for one canonical primary root — every
+	* granted member, ANY access level (a read-only root is still a member of
+	* the workspace for instructions, LSP, routing, and reads).
 	* @param primaryRoot - canonical primary root (or any spelling thereof).
 	* @returns the canonical additional roots; empty when none are registered.
 	*/
 	scopeOf(primaryRoot) {
-		const registered = this.rootsByPrimary.get(canonicalPath(primaryRoot));
+		return this.membersOf(primaryRoot).map((root) => root.path);
+	}
+	/**
+	* The additional roots a WRITE may reach for one primary root under
+	* `workspace-write` — the members whose effective access is writable there
+	* (`inherit` and fixed `read-write`). Tool caps are per-call and do not
+	* apply to this diagnostic projection.
+	* @param primaryRoot - canonical primary root (or any spelling thereof).
+	* @returns the canonical writable roots; empty when none qualify.
+	*/
+	writableOf(primaryRoot) {
+		return this.membersOf(primaryRoot).filter((root) => root.access !== "read-only").map((root) => root.path);
+	}
+	/**
+	* Whether ANY registered primary currently publishes an explicit `read-only`
+	* member. The PTY seam resolves its caller through the agent-PTY
+	* environment markers; when that lookup fails this flag is the difference
+	* between pass-through (nothing to deny anywhere on the store) and fail
+	* closed. An unavailable registry authority answers `true` by itself: a
+	* terminal whose session cannot be resolved must not inherit a deny set
+	* this process cannot see.
+	* @returns whether at least one primary holds a restricted root, or the
+	*   registry cannot prove none does.
+	*/
+	hasActiveDenyRoots() {
+		if (this.registryAuthority === "unavailable") return true;
+		for (const members of this.rootsByPrimary.values()) if (members.some((root) => root.access === "read-only") || members.length > 0 && this.capped()) return true;
+		return false;
+	}
+	/** The sanitized members of one primary root, in registry order. */
+	membersOf(primaryRoot) {
+		const key = canonicalPath(primaryRoot);
+		const registered = this.rootsByPrimary.get(key);
 		if (registered === void 0) return [];
-		return sanitizeAdditionalRoots(canonicalPath(primaryRoot), registered);
+		return sanitizeMembers(key, registered);
 	}
 	/**
 	* Replace the roots registered for one primary root.
@@ -144,6 +340,19 @@ var MultiRootScopeService = class extends Service {
 		else this.rootsByPrimary.set(key, [...roots]);
 		for (const listener of this.listeners) listener();
 	}
+	/**
+	* Publish the registry-authority fact. This is the REGISTRY's write port —
+	* the counterpart of {@link setAdditionalRoots}: the registry marks the
+	* scope `unavailable` the moment it stops being the store's authority
+	* (before acquisition, on contention or storage failure, at teardown) and
+	* `available` only once its stored records have been published. Nothing
+	* else may call it, and it never touches the root table.
+	* @param available - whether this process holds the registry authority.
+	*/
+	setRegistryAuthority(available) {
+		this.registryAuthority = available ? "available" : "unavailable";
+		for (const listener of this.listeners) listener();
+	}
 };
 //#endregion
-export { MULTI_ROOT_CONTEXT_NAME, MultiRootScopeService, MultiRootScopeService as default, renderWorkspaceRootsContext, sanitizeAdditionalRoots };
+export { MULTI_ROOT_CONTEXT_NAME, MultiRootScopeService, MultiRootScopeService as default, REGISTRY_UNAVAILABLE_NOTE, renderWorkspaceRootsContext, sanitizeAdditionalRoots };

package/lib/types/client/RootSwitcher.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The Files-tab root switcher — the entry that took over the header position
+ * the P1 gear launcher first claimed. It poses as the pane's path label: a
+ * trigger that opens a menu of this session's roots (primary first, the
+ * registered additional roots next, and the Workspace Folders manager last),
+ * followed by a `PathLabel` of the selected root's full path — the same
+ * component upstream draws in that spot, so both primary and additional
+ * selections read exactly like the native header. While an additional root
+ * is selected it also lends the pane's body area to this plugin's verbatim
+ * fork of the native Files tree (`files-tree/`), so an additional root reads
+ * and behaves exactly like the primary one.
+ *
+ * Two upstream DOM hooks make the takeover work, and both degrade silently:
+ *
+ * - The stylesheet rules: while `.mrfw-rootSwitcher` exists inside a
+ *   `[data-files-root]` pane the upstream `data-files-path` is hidden and the
+ *   switcher takes its flex position; while the switcher carries
+ *   `data-root-kind="additional"` the native `data-files-body`,
+ *   `data-files-reload`, and `data-open-target="directory"` split button
+ *   hide too (the reload refreshes the very tree that is no longer
+ *   visible, and the native open-in-app button only ever receives the
+ *   primary root through its slot props — the header gets a
+ *   `.mrfw-switcherReload` replacement and the plugin's verbatim fork of
+ *   the open-in-app control, pointed at the selected root). Upstream
+ *   changing that DOM shape simply stops the selectors from matching — the
+ *   native header keeps working and the switcher is just another actions
+ *   occupant.
+ * - `closest('[data-files-root]')` from the switcher's own element locates
+ *   the pane the forked Files tree is portaled into, as a sibling of
+ *   `data-files-body`. No match → no portal: the component keeps working as
+ *   a menu and the native tree keeps its area. The tree's tab id comes from
+ *   the same element's `closest('[data-dockkit-content]')` — the dockkit
+ *   tabHost section — with a generated fallback where the hook is absent.
+ *
+ * The selected root is component state on purpose: every tab render
+ * occurrence gets its own, and reopening the pane resets to the primary
+ * root. There is no cross-tab or persisted selection.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/RootSwitcher
+ */
+import { type ReactNode } from 'react';
+import { type FilesTreeSurface } from './files-tree/adapter.tsx';
+import { type OpenInAppAdapter } from './open-in-app/adapter.tsx';
+import { type WorkspaceFoldersActionProps } from './WorkspaceFoldersAction.tsx';
+/** What the registered Files-actions occupant needs beyond the slot owner. */
+export interface RootSwitcherProps extends Omit<WorkspaceFoldersActionProps, 'compact' | 'wide'> {
+    /** This pane's workspace root, carried by the slot owner's `absolutePath`. */
+    readonly primaryPath: string;
+    /**
+     * The forked open-in-app control's shared props, or `undefined` where the
+     * fork cannot render (an undefined adapter is upstream's own "no button"
+     * state, so the switcher just draws nothing there too).
+     */
+    readonly openInApp?: OpenInAppAdapter | undefined;
+    /**
+     * The forked Files tree's shared props, or `undefined` where the fork
+     * cannot render — the additional-root rows then stay out of the menu at
+     * all, which is the same absence upstream's own tree produces.
+     */
+    readonly filesTree?: FilesTreeSurface | undefined;
+}
+/** The Files-header switcher: root menu, dialog entry, and the portal tree. */
+export declare function RootSwitcher(props: RootSwitcherProps): ReactNode;

package/lib/types/client/WorkspaceFoldersAction.d.ts

@@ -16,11 +16,16 @@
  * native look — sidebar trigger, modal card, capsule buttons — in both themes
  * without naming a single color here (see ADR-0006).
  *
+ * The dialog itself is also exported: the Files-tab root switcher opens the
+ * same manager through its trailing menu item instead of carrying a second
+ * dialog.
+ *
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/WorkspaceFoldersAction
  */
 import { type ReactNode } from 'react';
 import { type PanelClient } from './panel-client.ts';
 import type { Key } from './locales.ts';
+import type { RootAccess, RootEntryView, RootState, RootView } from '../contract.ts';
 /** Translate one key of this plugin's namespace. */
 export type Translate = (key: Key, params?: Record<string, unknown>) => string;
 /** What the registered action receives from the plugin body. */
@@ -39,8 +44,41 @@ export interface WorkspaceFoldersActionProps {
     readonly subscribeSession?: (listener: () => void) => () => void;
     /** Whether the sidebar renders wide content (`false` in the icon rail). */
     readonly wide?: boolean;
-    /** Compact launcher in the upstream Files tab's public actions slot. */
+    /** Icon-only launcher in the upstream Files tab's public actions slot. */
     readonly compact?: boolean;
 }
+/** The locale key for one reported root state. */
+export declare function stateKey(state: RootState): Key;
+/** The locale key for one registration's access level. */
+export declare function accessKey(access: RootAccess): Key;
+/**
+ * Whether moving FROM `from` TO `to` could widen the agent's write authority
+ * under some session mode. The three levels are not a total order — `inherit`
+ * is weaker than `read-write` under a read-only session but never weaker
+ * under the others — so the check is spelled out per pair rather than
+ * computed from a rank. Only a widening change asks for confirmation.
+ */
+export declare function widensAccess(from: RootAccess, to: RootAccess): boolean;
+/** The final segment of an absolute path, on either platform separator. */
+export declare function basename(path: string): string;
+/**
+ * The primary text of one row: the stored alias when set, otherwise the
+ * directory's own name — the display the registration was added with.
+ */
+export declare function displayNameOf(root: RootView): string;
 /** The sidebar footer action plus the dialog it opens. */
 export declare function WorkspaceFoldersAction(props: WorkspaceFoldersActionProps): ReactNode;
+/** The exact row reference the browsing endpoints and mutations carry. */
+export declare function entryOf(root: RootView): RootEntryView;
+/**
+ * The dialog: reads the view once per open, then after every mutation.
+ *
+ * Two shapes travel back over the channel, and they are handled separately on
+ * purpose: every mutating endpoint answers with the whole refreshed view, while
+ * `reveal` answers with the path it revealed and leaves the list untouched
+ * (see `contract.ts`). Treating a reveal answer as a roots view is exactly the
+ * contract mismatch this split removes.
+ */
+export declare function WorkspaceFoldersDialog(props: WorkspaceFoldersActionProps & {
+    onClose: () => void;
+}): ReactNode;

package/lib/types/client/files-tree/FilesBody.module.css.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shim for the CSS-module virtual module `./FilesBody.module.css`.
+ *
+ * This toolchain resolves real files, not CSS-module virtual modules — so
+ * the forked body imports this file instead (the one-line specifier delta
+ * recorded in FORK.md). It exports the same `css.<name>` map, pointed at the
+ * plugin-prefixed `mrfw-ft*` classes whose rules live in `styles.ts`; the
+ * upstream `FilesBody.module.css` sits beside it verbatim as the diffable
+ * source. Only the names the fork's JSX actually reads are mapped — the
+ * header-only entries (`root`, `header`, `path`, `tool`, `status`,
+ * `statusLine`, `titleIcon`) belong to the shell this fork drops.
+ */
+declare const css: {
+    readonly body: "mrfw-ftBody";
+    readonly level: "mrfw-ftLevel";
+    readonly item: "mrfw-ftItem";
+    readonly row: "mrfw-ftRow";
+    readonly icon: "mrfw-ftIcon";
+    readonly fileIcon: "mrfw-ftFileIcon";
+    readonly name: "mrfw-ftName";
+    readonly other: "mrfw-ftOther";
+    readonly note: "mrfw-ftNote";
+};
+export default css;

package/lib/types/client/files-tree/FilesTree.d.ts

@@ -0,0 +1,47 @@
+import type { ReactNode } from 'react';
+import type { RemoteFailure } from '@deepseek-ai/dsh-api-remotes/client';
+import type { PropsLocale, PropsStore, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots';
+import type { TabId } from '@deepseek-ai/dsh-client-ui-dockkit';
+import type { SessionId } from '@deepseek-ai/dsh-session/types';
+import type { WorkspaceDirectoryEntry } from '@deepseek-ai/dsh-api-workspace-files/types';
+import type { FilesInjected } from './face.ts';
+import type { createFilesStore } from './store.ts';
+/**
+ * The fork's props: the store/locale shares verbatim from upstream's
+ * composed props, `start`/`toggle` from the injected face, and the four
+ * seams upstream binds inside `FilesBody` — tab id, lifetime, root, and the
+ * resource-opening callback — supplied by the adapter instead.
+ */
+export type FilesTreeProps = PropsStore<ReturnType<typeof createFilesStore>> & Pick<FilesInjected, 'start' | 'toggle'> & PropsLocale<'sidebarFiles'> & {
+    /** The store bucket this tree reads and writes — the pane's own dockkit tab id. */
+    readonly tabId: TabId;
+    /** Session the listing and the resource addresses belong to. */
+    readonly sessionId: SessionId;
+    /** Absolute path of the root this tree lists (the selected additional root). */
+    readonly root: string;
+    /** Takeover lifetime: aborting forgets the bucket and closes the watch tree. */
+    readonly signal: AbortSignal;
+    /** Open one `dsh-resource://file` address (the adapter's sidebarRight route). */
+    readonly onOpen: (address: string) => void;
+};
+/**
+ * Order one level's entries for display: directories first, then everything
+ * else, each group by name. The endpoint's order is a listing fact; this is the
+ * reader's.
+ * @param entries - the listing as the endpoint returned it.
+ * @returns a new array, directories first, then by name within each group.
+ */
+export declare function orderEntries(entries: readonly WorkspaceDirectoryEntry[]): WorkspaceDirectoryEntry[];
+/**
+ * Say why a directory could not be listed, in terms of the directory.
+ * @param t - namespace-bound translate.
+ * @param failure - the settled Remote failure.
+ * @returns the line to show under the directory.
+ */
+export declare function failureLine(t: TranslateNS<'sidebarFiles'>, failure: RemoteFailure): string;
+/**
+ * The additional-root tree's body: the selected root and whatever the reader
+ * has opened under it — the upstream body's scroll, seed, and render logic
+ * verbatim, with the root arriving as a prop instead of `useSessions(cwd)`.
+ */
+export declare function FilesTree({ tabId, sessionId, root, signal, useStore, actions, start, toggle, onOpen, t, }: FilesTreeProps): ReactNode;

package/lib/types/client/files-tree/adapter.d.ts

@@ -0,0 +1,94 @@
+/**
+ * The plugin-owned wiring around the verbatim files-tree fork.
+ *
+ * Upstream wires its store and face inside `apply` over `ctx.remote`, and the
+ * slot framework resolves the session and hands the face its bound actions.
+ * This plugin registers onto `sidebar.right.tab.files.actions` — a
+ * session-scoped list slot — so the same `store`/`inject` declaration gives
+ * the fork the same props; what differs is only *which* remote and *which*
+ * open-route the fork sees:
+ *
+ * - `remote` is an optional service here (upstream injects it unconditionally),
+ *   so {@link lazyFilesRemote} resolves `remote` / `remote.workspaceFiles` per
+ *   call through `ctx.get` — the inject-free lookup, since a declaration would
+ *   gate this whole row on an optional service — and folds absence into the
+ *   same `gateway/internal` failure a carrier error would produce;
+ * - opening a file goes through `sidebarRight.openResourceIn`, bound with the
+ *   session inside the `inject` factory so the component never resolves one;
+ * - the primitives the forked rows spell are runtime-probed (pixel-era
+ *   manifests lack the `*Regular` names), and the gate's `false` means the
+ *   caller simply never mounts the tree — upstream's own absence shape.
+ *
+ * Everything here is ours; nothing in this file needs upstream sync.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/client/files-tree/adapter
+ */
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import type { ClientRemote } from '@deepseek-ai/dsh-api-remotes/client';
+import type { BoundActions } from '@deepseek-ai/dsh-client-store';
+import type { SessionId } from '@deepseek-ai/dsh-session/types';
+import { type FilesInjected } from './face.ts';
+import { createFilesStore } from './store.ts';
+import { filesTreeSurfaceSupported } from './primitives.ts';
+import type { FilesTreeProps } from './FilesTree.tsx';
+import { NS } from './locales.ts';
+/** The inject face the registration composes onto the occupant's props. */
+export interface FilesTreeInjected {
+    /** The verbatim files face (list/watch bookkeeping included). */
+    readonly face: FilesInjected;
+    /** Open one `dsh-resource://file` address in the host viewer. */
+    readonly openFile: (address: string) => void;
+}
+/** Everything `FilesTree` needs that the slot framework does not synthesize. */
+export interface FilesTreeSurface {
+    readonly sessionId: SessionId;
+    readonly useStore: FilesTreeProps['useStore'];
+    readonly actions: FilesTreeProps['actions'];
+    readonly face: FilesInjected;
+    readonly openFile: (address: string) => void;
+    readonly t: FilesTreeProps['t'];
+}
+/**
+ * A `ClientRemote` stand-in that resolves the real service per call.
+ *
+ * The verbatim `createList`/`createWatch` hold one remote face for the
+ * session's life; resolving lazily keeps the fork correct on compositions
+ * that acquire `remote` after this plugin activates, and a composition that
+ * never acquires it still answers every call — with the same failure kind a
+ * dead carrier returns — instead of crashing the slot. Every method upholds
+ * the Remote contract the face relies on: `list` resolves a `RemoteResult`
+ * and never rejects; `changes`/`$stream` surface synchronous lookup failures
+ * through the stream's own failure path.
+ */
+export declare function lazyFilesRemote(ctx: ClientContext): ClientRemote;
+/**
+ * The registration's `store`/`inject` declarations, built once in `apply`.
+ *
+ * The inject face nests the verbatim files face under `face` and adds the
+ * session-bound `openFile` — keeping `FilesInjected` untouched means the
+ * fork's call sites and the sync diff stay upstream-shaped.
+ * @param ctx - the client root context (the remote/sidebarRight lookups).
+ * @returns the store handle and the inject factory for `register`.
+ */
+export declare function createFilesTreeSeats(ctx: ClientContext): {
+    readonly store: ReturnType<typeof createFilesStore>;
+    readonly inject: (sessionId: SessionId, actions: BoundActions<ReturnType<typeof createFilesStore>>) => FilesTreeInjected;
+};
+/**
+ * Assemble the props `RootSwitcher` portals into `FilesTree`, or `undefined`
+ * when this composition cannot render the fork — the caller then keeps the
+ * additional-root rows out of the menu entirely, which is the same absence
+ * upstream produces when its own tree cannot draw.
+ * @param props - the occupant's composed props (store, inject, session shares).
+ * @param t - the `sidebarFiles`-bound translate.
+ * @returns the stable surface, or `undefined` when the fork cannot mount.
+ */
+export declare function createFilesTreeSurface(props: {
+    readonly sessionId: SessionId;
+    readonly useStore: FilesTreeSurface['useStore'];
+    readonly actions: FilesTreeSurface['actions'];
+    readonly face: FilesInjected | undefined;
+    readonly openFile: ((address: string) => void) | undefined;
+}, t: FilesTreeProps['t']): FilesTreeSurface | undefined;
+export { filesTreeSurfaceSupported, NS as FILES_TREE_NS };
+export { FilesTree } from './FilesTree.tsx';