@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.8

package/lib/types/compat/windows-path-guard.d.ts

@@ -0,0 +1,56 @@
+/** Windows deny-path pinning (branch-review Phase B).
+ *
+ * The ACL writer's deny ACEs follow the file OBJECT, not the registered
+ * spelling: a restricted process that renames a deny root's ancestor moves
+ * the protected tree to a NEW path the recorded deny set does not name — the
+ * kernel still refuses that token's writes through the moved ACEs, but the
+ * host fs fence, which matches the recorded spellings, no longer covers the
+ * moved objects (the shell → host new-path gap, R1). This guard pins every
+ * ancestor directory of every deny root with an open handle that shares read
+ * and write but NOT delete — so a rename or delete of the registered tree
+ * fails for the lifetime of the restricted child, without writing a single
+ * persistent ACL on `C:\`, user directories, or anywhere else.
+ *
+ * `windows-deny.ts` owns the lifetime contract: handles are held until the
+ * confined child AND its drained Job descendants have exited.
+ *
+ * Primitives are bound through the public `extendWin32ProcessBindings` seam —
+ * no upstream private file, no new native dependency. Every verification uses
+ * the same handle that pins the directory, so the checked object and the
+ * pinned object are always the same one.
+ */
+import type { NativeApi, NativePointer, WindowsNative } from './windows-native.ts';
+/** What `GetFileInformationByHandle` reports for one pinned object. */
+export interface WindowsPathIdentity {
+    readonly attributes: number;
+    readonly volumeSerial: number;
+    readonly fileIndex: bigint;
+    readonly links: number;
+}
+/** Held ancestor pins. {@link WindowsPathGuard.close} releases every handle. */
+export interface WindowsPathGuard {
+    close(): void;
+}
+/** BY_HANDLE_FILE_INFORMATION is 52 bytes (FILETIME members are DWORD-pairs):
+ * attributes @0, volume serial @28, link count @40, file index high @44 /
+ * low @48. Read back on the same handle that pins the path, so the identity
+ * cannot drift between check and pin.
+ */
+export declare function readWindowsPathIdentity(api: NativeApi, handle: NativePointer): WindowsPathIdentity;
+/**
+ * Open a pin handle on every ancestor of every deny root — including the deny
+ * root itself — and hold them all until {@link WindowsPathGuard.close}. Each
+ * handle is opened with GENERIC_READ, read+write sharing, and a null security
+ * descriptor so it is non-inheritable; the missing DELETE sharing is what
+ * blocks renames, while ordinary reads and writes (and creating sibling files
+ * inside a pinned directory) keep working.
+ *
+ * Every pin is verified on the same handle: the object must be a directory,
+ * must not be a reparse point, must not carry the inherit flag (so a confined
+ * child cannot simply `CloseHandle` the pin away), and its kernel-reported
+ * final DOS path must equal the expected canonical spelling.
+ * Any failure — open, verification, or a sharing conflict with a handle some
+ * other component already holds — closes every earlier pin in reverse order
+ * and refuses, keeping the launch fail-closed before spawn.
+ */
+export declare function pinWindowsDenyPaths(native: WindowsNative, roots: readonly string[]): WindowsPathGuard;

package/lib/types/compat/workspace-files.d.ts

@@ -2,4 +2,6 @@
 import type { WorkspaceFiles, WorkspaceFileScope, WorkspaceFileWatchFrame } from '@deepseek-ai/dsh-api-workspace-files';
 type PathWatch = (this: WorkspaceFiles, scope: WorkspaceFileScope, path: string, signal: AbortSignal) => AsyncIterable<WorkspaceFileWatchFrame>;
 export declare function adaptPathWatch(service: WorkspaceFiles, wrap: (original: PathWatch) => PathWatch): () => void;
+/** Match both legacy `readRelated` and modern `readBytes({ baseFile })` tail resolution. */
+export declare function resolveRelatedWorkspacePath(absoluteBase: string, tail: string): string;
 export {};

package/lib/types/compat.d.ts

@@ -2,16 +2,26 @@
  * `multi-root-compat`: the startup gate that turns the DSH compatibility
  * contract from documentation into a precondition.
  *
- * The four security-relevant rows of this bundle — `multi-root-fs`,
- * `multi-root-sandbox`, `multi-root-registry`, `multi-root-instructions` —
- * inject `multiRootCompat`. Cordis will not start a plugin whose injected
- * service is absent, so this row is what decides whether they run at all:
+ * Every widened-authority row of this bundle — `multi-root-providers`,
+ * `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
+ * `multi-root-workspace-files`, `multi-root-process-fence` — injects
+ * `multiRootCompat`. Cordis will not start a plugin whose injected service is
+ * absent, so this row is what decides whether they run at all:
  *
  * ```text
- * compat check passes  →  ctx.multiRootCompat exists  →  the providers start
+ * compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
  * compat check fails   →  the row throws             →  they never start
  * ```
  *
+ * The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
+ * do NOT inject the gate: their widening is scope-driven, and the gated
+ * registry can never populate the scope on a refused installation — so they
+ * degenerate to the upstream providers. That is what keeps a refused gate a
+ * loud degradation (the plugin's features absent, the profile intact) instead
+ * of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
+ * the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+ * `permissionPresets` and every confining tool down with them.
+ *
  * That is why the gate is a plain `apply` and not a `Service` subclass mounted
  * directly: the check has to be able to fail BEFORE the service exists. A
  * `Service` constructor has already run `super(ctx, name)` — and therefore

package/lib/types/contract.d.ts

@@ -13,7 +13,7 @@
  *   from endpoint to response type, so the panel cannot silently decode one
  *   endpoint's answer as another's. `reveal` answers with
  *   {@link RevealedView}; root-management endpoints answer with
- *   {@link RootsView}, and browsing returns {@link FilesView} or {@link FilePreview}.
+ *   {@link RootsView}.
  *   The host builds those answers in `command.ts` and the
  *   panel parses them here — one definition, two consumers.
  * - **Runtime validation at the boundary.** The payload arrives from a browser
@@ -31,21 +31,9 @@
 /** The absolute logical channel both halves speak over. */
 export declare const PANEL_CHANNEL = "/multi-root-workspace";
 /** Endpoint names, relative to {@link PANEL_CHANNEL}. */
-export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'reveal' | 'files' | 'readFile';
+export type PanelEndpoint = 'list' | 'add' | 'remove' | 'alias' | 'move' | 'setAccess' | 'reveal';
 /** Every endpoint name, for exhaustive iteration in tests and callers. */
 export declare const PANEL_ENDPOINTS: readonly PanelEndpoint[];
-export interface FilesView {
-    readonly path: string;
-    readonly entries: readonly {
-        readonly name: string;
-        readonly type: 'file' | 'directory' | 'other';
-    }[];
-    readonly truncated: boolean;
-}
-export interface FilePreview {
-    readonly text: string;
-    readonly eof: boolean;
-}
 /**
  * How one registered root currently stands, as the panel renders it. Kept in
  * step with the root vocabulary in `src/roots.ts` deliberately: this module is
@@ -53,6 +41,17 @@ export interface FilePreview {
  * value the two sides share is spelled out rather than imported.
  */
 export type RootState = 'available' | 'missing' | 'redirected' | 'invalid';
+/**
+ * The write authority one registration carries (B9 three-state), spelled out
+ * rather than imported: this module is inlined into the browser bundle and
+ * must not pull in `node:*`, so the one value the two sides share is
+ * duplicated here.
+ */
+export type RootAccess = 'inherit' | 'read-write' | 'read-only';
+export type WorkspaceMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+export type EffectiveRootAccess = 'read-only' | 'read-write' | 'full-access' | 'unavailable';
+/** The shared nine-cell rule; tool dispatch may subsequently narrow writes. */
+export declare function effectiveRootAccess(access: RootAccess, mode: WorkspaceMode): EffectiveRootAccess;
 /** One root as the panel renders it. */
 export interface RootView {
     /** 1-based position in the returned snapshot. */
@@ -67,6 +66,10 @@ export interface RootView {
     readonly addedAt: string;
     /** Whether the directory is writable right now, withheld, or unusable. */
     readonly state: RootState;
+    /** The write authority the registration carries. */
+    readonly access: RootAccess;
+    /** Host-derived session permission, before any per-tool cap. */
+    readonly effectiveAccess?: EffectiveRootAccess;
     /** Why the root is not `available`; a code the panel localizes. */
     readonly detail?: string;
 }
@@ -89,8 +92,18 @@ export interface RootsView {
     readonly primaryName?: string;
     /** Execution directory only; never a registry key or an authorization grant. */
     readonly effectiveCwd?: string;
+    readonly mode?: WorkspaceMode;
+    readonly cappedTools?: readonly string[];
+    readonly toolAccessInvalid?: boolean;
     /** The additional roots, in registry order. */
     readonly roots: readonly RootView[];
+    /** The host cap; MAX_SAFE_INTEGER means a legacy host reported no limit. */
+    readonly limit: number;
+    /**
+     * How many records are stored, in every state. `count > limit` is a
+     * historical over-limit store: everything stays granted, only adds refuse.
+     */
+    readonly count: number;
     /** Set when the store itself could not be read; the panel shows this verbatim. */
     readonly unavailable?: string;
 }
@@ -106,9 +119,8 @@ export interface PanelResponseMap {
     readonly remove: RootsView;
     readonly alias: RootsView;
     readonly move: RootsView;
+    readonly setAccess: RootsView;
     readonly reveal: RevealedView;
-    readonly files: FilesView;
-    readonly readFile: FilePreview;
 }
 /**
  * The fields a request may carry. `sessionId` is required on every endpoint:
@@ -123,10 +135,12 @@ export interface PanelRequest {
     readonly entry?: RootEntryView;
     /** Compatibility reference; accepted only when the id is unique. */
     readonly id?: string;
-    /** Candidate directory (add), or root-relative browsing path (files/readFile). */
+    /** Candidate directory (add). */
     readonly path?: string;
     /** Display alias (add/alias); empty clears it. */
     readonly alias?: string;
+    /** Write authority (add — defaults to `inherit` — and setAccess). */
+    readonly access?: RootAccess;
     /** Exact anchor row (move): the target is placed in front of it; absent moves it last. */
     readonly beforeEntry?: RootEntryView;
     /** Compatibility anchor; accepted only when the id is unique. */
@@ -152,8 +166,6 @@ export type Parsed<T> = {
     readonly ok: false;
     readonly message: string;
 };
-export declare function parseFilesView(value: unknown): Parsed<FilesView>;
-export declare function parseFilePreview(value: unknown): Parsed<FilePreview>;
 /**
  * Validate the payload the host received for one endpoint.
  * @param endpoint - the endpoint the channel dispatched (the RPC method).

package/lib/types/dialects.d.ts

@@ -35,16 +35,20 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/dialects
  */
 import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox';
+import { DialectUnrecognizedError } from './windows-runner-contract.ts';
 /** The kernel runner dialects a confined argv can speak. */
 export type RunnerDialect = 'seatbelt' | 'bwrap' | 'landlock' | 'windows-acl';
 /**
  * Raised when a confined argv cannot be recognized or widened. The provider
  * converts this into the fail-closed `SandboxUnavailableError`: an unrecognized
  * dialect must never degrade into "the primary root was granted after all".
+ *
+ * The class itself lives in `windows-runner-contract.ts`: the standalone
+ * Windows runner's module graph may import node builtins only, so the shared
+ * error type cannot sit in a module that (even type-only) references upstream
+ * packages. Re-exported here unchanged — `instanceof` identity is preserved.
  */
-export declare class DialectUnrecognizedError extends Error {
-    constructor(message: string);
-}
+export { DialectUnrecognizedError };
 /** One wrapped argv split into its runner/profile part and the caller's argv. */
 export interface ConfinedShape {
     /** The recognized dialect. */
@@ -90,3 +94,95 @@ export declare function detectDialect(profileArgs: readonly string[]): RunnerDia
  * @returns the widened profile arguments.
  */
 export declare function widenProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], policy: SandboxPolicy, additionalRoots: readonly string[]): string[];
+/**
+ * Graft writable grants onto a `read-only` profile — the B9 cell where a fixed
+ * `read-write` additional root stays writable while the session mode denies
+ * every other write. Each dialect appends its own grant spelling AFTER
+ * upstream's deny-all baseline, so the appended form wins:
+ *
+ * - seatbelt: SBPL is last-match-wins — a trailing `(allow file-write*
+ *   (subpath …))` overrides the blanket `(deny file-write*)` for those roots;
+ * - bwrap: mounts apply in order — a `--bind W W` after `--ro-bind / /`
+ *   re-mounts that subtree writable inside the read-only namespace;
+ * - landlock: grants union — an extra `--rw W` widens exactly that subtree.
+ *
+ * `windows-acl` cannot be spelled this way and goes through
+ * `widenWindowsProfile` (the standalone runner grants only the listed roots).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream read-only profile arguments.
+ * @param additionalRoots - canonical roots the effective scope keeps writable.
+ * @returns the grafted profile arguments.
+ */
+export declare function graftProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], additionalRoots: readonly string[]): string[];
+/**
+ * Deny `deniedRoots` inside an upstream `workspace-write` profile — the B9 edge
+ * where an explicit `read-only` (or tool-capped) additional root sits under a
+ * directory the profile grants writable (the platform temp area, which an
+ * additional root may legitimately be registered beneath).
+ *
+ * A denied root outside every grant needs no profile work at all: the mode
+ * already denies it. Per dialect:
+ *
+ * - seatbelt appends a trailing `(deny file-write* (subpath …) (literal …))`
+ *   form — last match wins over every earlier allow, and a redundant deny on
+ *   an ungranted root is harmless. The literals pin every ancestor of a denied
+ *   root: Seatbelt checks the operated path only, so `rename`ing an ancestor
+ *   would otherwise move the whole tree out from under its `subpath` deny;
+ * - bwrap re-mounts the root `--ro-bind` AFTER the writable mounts (a later
+ *   mount wins inside the namespace). The source is mandatory: if a denied
+ *   root disappears, namespace setup fails before the command can recreate it.
+ *   This also restores read access to denied roots under a `--tmpfs` target.
+ *   Ancestors of a denied root that lie strictly inside a writable BIND target
+ *   are self-bound (`--bind A A`) BEFORE the ro-binds: the kernel refuses to
+ *   rename a mountpoint, so the deny can no longer be walked off by renaming
+ *   the tree's parent. Ancestors inside a `--tmpfs` target are never bound —
+ *   a rename there only moves namespace-private mounts, while the self-bind
+ *   would expose and make writable the host content the tmpfs hides — and
+ *   ancestors outside every writable target are not renamable anyway;
+ * - landlock cannot subtract: a denied root under an `--rw` grant throws —
+ *   union semantics have no deny primitive;
+ * - windows-acl goes through `widenWindowsProfile`, whose runner-side ACL
+ *   grant cannot subtract either — its caller checks the same overlap. The
+ *   deny ACE does follow its directory object through a parent rename, but
+ *   the moved tree's NEW path no longer matches the recorded deny set — so
+ *   the ambient deny runner pins every ancestor of each deny root with a
+ *   non-delete-sharing handle for the child lifetime (`windows-path-guard.ts`,
+ *   `windows-deny.ts`).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream workspace-write profile arguments.
+ * @param deniedRoots - canonical roots this call must not write.
+ * @returns the profile arguments with the in-profile denies applied.
+ */
+export declare function denyProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], deniedRoots: readonly string[]): string[];
+/**
+ * Restrict an ambient-writable execution to everything EXCEPT `deniedRoots` —
+ * the B9 cell `danger-full-access` + explicit `read-only`. The consumers of
+ * this profile (shell, PTY, PTC) bypass `confine()` entirely under that mode,
+ * so the process fence builds this profile from an upstream skeleton instead:
+ * the caller probes `confine` once under `read-only` to obtain the runner's
+ * argument prefix, and this function rewrites the file-effect part.
+ *
+ * - seatbelt: `(version 1) (allow default)` kept from the profile head, plus a
+ *   trailing `(deny file-write* (subpath …) (literal …))` — allow-default with
+ *   subpath carve-outs, the inverse of the confined profiles. The literals
+ *   pin every ancestor of a denied root, so `rename`ing the tree's parent
+ *   cannot walk it out from under the deny (Seatbelt checks the operated
+ *   path only — verified natively on macOS);
+ * - bwrap: `--ro-bind / /` becomes `--bind / /` (ambient writable namespace),
+ *   each denied root is re-mounted `--ro-bind` after it, and every ancestor
+ *   of a denied root is self-bound `--bind A A` between the root mount and the
+ *   ro-binds — a mountpoint cannot be renamed (EBUSY), so the deny follows no
+ *   rename of the tree's ancestors. A missing source fails the launch,
+ *   retaining the registered negative authorization;
+ * - landlock cannot express "everything except" — its launcher only unions
+ *   allowlists, so it throws. windows-acl expresses the cell through the
+ *   standalone ambient-deny runner instead of this profile rewrite: standing
+ *   deny ACEs on every denied object, plus ancestor pin handles held through
+ *   the child and its drained Job descendants so no rename can vacate the
+ *   registered spelling (`windows-deny.ts`, `windows-path-guard.ts`).
+ * @param dialect - the recognized dialect.
+ * @param profileArgs - the upstream read-only skeleton's profile arguments.
+ * @param deniedRoots - canonical roots the execution must not write.
+ * @returns the restricted profile arguments.
+ */
+export declare function restrictProfileArgs(dialect: RunnerDialect, profileArgs: readonly string[], deniedRoots: readonly string[]): string[];

package/lib/types/fs.d.ts

@@ -65,22 +65,44 @@ export declare class MultiRootFileSystem extends LocalFileSystem {
         version: FsVersion;
     }, signal?: AbortSignal, sandboxPolicy?: SandboxExecutionPolicy): Promise<FsEditOutcome>;
     /**
-     * The writable roots of one workspace-write call: the upstream derivation
-     * (primary root plus the platform temp areas, canonical and deduplicated)
-     * widened by the scope's additional roots, in scope order.
+     * The writable roots of one confined call: the upstream derivation (primary
+     * root plus the platform temp areas, canonical and deduplicated — empty
+     * under `read-only`) widened by the scope's EFFECTIVE writable members.
+     * Under `read-only` that is exactly the fixed `read-write` roots (the tool
+     * cap may already have emptied the scope's list), so an explicit grant
+     * survives a globally read-only session. An unavailable registry authority
+     * never contributes members: a process that cannot read the store grants
+     * only the primary root (and no shared temp grant).
      * @param policy - the per-call policy.
      * @param scope - the scope resolved once for this call; both the fence and
      *   the denial message below share it instead of re-resolving.
-     * @returns the canonical writable roots; empty under `read-only`.
+     * @returns the canonical writable roots; possibly empty.
      */
     private rootsFor;
     /**
-     * Enforce the per-call policy against `target` and return the EXACT target the
-     * mutation must use, so the checked identity is the mutated one (no
-     * check-here-write-there TOCTOU). `read-only` denies; `workspace-write`
-     * re-canonicalizes NOW (reflecting a concurrently swapped symlink ancestor),
-     * requires containment under one of the scope's writable roots, and returns
-     * THAT fresh target; `danger-full-access` returns the caller's target unfenced.
+     * Enforce the per-call policy against `target` and return the EXACT target
+     * the mutation must use, so the checked identity is the mutated one (no
+     * check-here-write-there TOCTOU). Deny precedes containment: a root in
+     * `scope.deniedRoots` — an explicit `read-only` root, or any member when the
+     * call is tool-capped — refuses writes under EVERY mode, including
+     * `danger-full-access` and where a broader grant (the platform temp area)
+     * would otherwise cover the path. `read-only` then grants only the fixed
+     * `read-write` members; `workspace-write` requires containment under the
+     * widened writable set.
+     *
+     * `danger-full-access` is the only mode with a fast path, and only while
+     * the deny set is empty: it then returns the caller's target untouched,
+     * upstream-exact. Once ANY deny boundary exists the caller's `FsTarget` may
+     * be stale — the directory it resolved through can since have been replaced
+     * by a symlink into a denied root — so the fence re-resolves
+     * `target.displayPath`, checks the FRESH target key, and mutates that fresh
+     * target rather than the stale one the caller resolved earlier.
+     *
+     * One more Full-access rule: while the registry authority is `unavailable`
+     * the empty deny set is not trustworthy — the store this process cannot
+     * read may hold explicit `read-only` registrations — so the mode degrades
+     * to primary-root-only writes (no shared temp or additional-root grants)
+     * until the authority returns.
      * @param target - the resolved target about to be mutated.
      * @param sandboxPolicy - the per-call policy; omit for the deployment fallback.
      * @returns the fresh canonical target the mutation must use.

package/lib/types/index.d.ts

@@ -21,16 +21,20 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace
  */
 export { DshCompatUnsupportedError, MultiRootCompatService, assertSupportedInstallation } from './compat.ts';
-export { classifyInstallation, compatEnforcement, CORE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
+export { classifyInstallation, compatEnforcement, CORE_PACKAGES, HOST_SERVICE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, RUNNER_ANCHORED_PACKAGES, RUNTIME_OPTIONAL_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
 export type { CompatEnforcement, CompatReport, CompatVerdict, InspectedPackage, SupportedDshRelease, VersionReader, } from './compat/dsh-version.ts';
 export { instructionsApi, renderInstructions } from './compat/agent-instructions.ts';
 export type { InstructionsApi, RenderedInstructions } from './compat/agent-instructions.ts';
+export { AGENT_PTY_MARKER, agentPtyMarkerVerdict, assertAgentPtyMarker, PtyMarkerContractError } from './compat/pty-marker.ts';
+export type { AgentPtyMarkerIo, AgentPtyMarkerVerdict } from './compat/pty-marker.ts';
 export { createInstructionMessage } from './compat/llm-message.ts';
 export type { InstructionMessageInput } from './compat/llm-message.ts';
 export { widenConfined } from './compat/sandbox-confine.ts';
 export type { ConfineCall, UpstreamConfined } from './compat/sandbox-confine.ts';
 export { composeInstructionMessage, DEFAULT_MAX_BYTES, PLUGIN_SOURCE } from './instructions.ts';
 export type { Config as InstructionsConfig } from './instructions.ts';
+export { MultiRootProviders, brandMultiRootProvider, isMultiRootProvider, MULTI_ROOT_PROVIDER_BRAND } from './providers.ts';
+export type { ProviderKind } from './providers.ts';
 export { MultiRootFileSystem } from './fs.ts';
 export type { Config as FileSystemConfig } from './fs.ts';
 export { MultiRootSandboxProvider } from './sandbox.ts';
@@ -38,14 +42,15 @@ export type { Config as SandboxConfig } from './sandbox.ts';
 export { MultiRootScopeService, sanitizeAdditionalRoots, renderWorkspaceRootsContext } from './scope.ts';
 export type { AdditionalWorkspaceRoot, FilesystemScope } from './scope.ts';
 export { MultiRootRegistry, DOMAIN_NAME, MAX_ALIAS_LENGTH, REGISTRY_CONTENDED_MESSAGE, multiRootDomainSpec } from './registry.ts';
+export { DEFAULT_MAX_ADDITIONAL_ROOTS, MAX_ADDITIONAL_ROOTS_CEILING } from './registry.ts';
 export type { AddRootInput, Config as RegistryConfig, PersistedPrimaryRoot, RegistryAuthorityState } from './registry.ts';
 export { RegistryAuthorityLease, RegistryLeaseContendedError } from './registry-lease.ts';
 export { availableRoots, canonicalRoot, classifyStoredRoots, expandRootInput, indexedStatuses, isCanonicallyUnder, additionalRootId, removeStatusAt, resolveRootRef, RootValidationError, validateRootCandidate, } from './roots.ts';
 export type { AdditionalRootId, RegisteredRoot, RootRef, RootState, RootStatus, RootValidationCode, } from './roots.ts';
 export { COMMAND_NAME, parseFoldersCommand, renderRootsReport, resolvePanelPrimaryRoot, revealArgv } from './command.ts';
 export type { FoldersCommand } from './command.ts';
-export { PANEL_CHANNEL, PANEL_ENDPOINTS, parsePanelCall, parseRevealedView, parseRootsView, parseFilesView, parseFilePreview } from './contract.ts';
-export type { FilesView, FilePreview, PanelCall, PanelEndpoint, PanelFailure, PanelRequest, PanelResponseMap, RevealedView, RootView, RootsView, } from './contract.ts';
+export { PANEL_CHANNEL, PANEL_ENDPOINTS, parsePanelCall, parseRevealedView, parseRootsView } from './contract.ts';
+export type { PanelCall, PanelEndpoint, PanelFailure, PanelRequest, PanelResponseMap, RevealedView, RootView, RootsView, } from './contract.ts';
 /**
  * Carrier plugin face for the bare-package-name loader row (see the module
  * doc). It deliberately provides nothing: every host responsibility is owned

package/lib/types/process-fence.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `multi-root-process-fence`: the B9 seam for the one cell `ctx.sandbox.confine`
+ * never sees — `danger-full-access` with explicit `read-only` additional roots.
+ *
+ * Upstream, every confined consumer routes through `ctx.sandbox.confine`, which
+ * this bundle's provider already widens (grants, the read-only fixed-write
+ * graft, and the workspace-write deny edge). But the shell executor, the PTC
+ * runtime and the PTY backend all short-circuit that mode: `policy.mode ===
+ * 'danger-full-access'` returns the bare argv, so an explicit `read-only` root
+ * would silently stay writable. This row closes the gap without touching any
+ * upstream executor:
+ *
+ * - `ctx.subprocess.spawn` is wrapped to prepend a precomputed restricted
+ *   profile whenever the AsyncLocalStorage below carries one. `spawn` is
+ *   synchronous, so the profile — which never depends on the callee's argv —
+ *   is built by the wrapping consumer, not here.
+ * - `ctx.shell.execute` (bash and pwsh alike, and `start` where an older
+ *   release still exposes it — `compat/process-entrypoints.ts` owns which
+ *   entries a mounted executor actually carries) resolves the per-call policy
+ *   exactly the way the executor itself does, and — under Full-access with
+ *   deny roots — asks the sandbox provider for the restricted prefix and runs
+ *   the call inside the store, so every subprocess the executor launches is
+ *   confined.
+ * - `ctx.ptcRuntime.run` does the same for `run_code`.
+ * - `ctx.subprocess.spawnTerminal` keys on the `DSH_PTY_SESSION_ID` marker:
+ *   every supported `dsh-terminal-bash` backend stamps it (alongside
+ *   `DSH_SESSION_ID`) when it launches an agent's PTY, and no other caller —
+ *   above all the panel's terminal controller — ever sets it. A spec without
+ *   the marker is a USER terminal, passed through untouched in every mode:
+ *   the sandbox protects agent behavior, and upstream never confines the
+ *   user's own terminal. Because that marker is the ONLY discriminator, the
+ *   `multi-root-compat` gate asserts it at boot (`compat/pty-marker.ts`):
+ *   an installed backend whose emitted code no longer stamps it fails the
+ *   plugin load rather than silently reclassifying agent PTYs as the user's.
+ *   `ctx.terminals` itself is deliberately NOT wrapped:
+ *   upstream mounts it inside `optional-persistent-terminals` with
+ *   `isolate: { terminals: true }`, so the registry entry is unreachable from
+ *   this row — the shared `spawnTerminal` seam plus the env discriminator
+ *   covers both the un-isolated SDK mount and the isolated web mount.
+ *
+ * The same seam carries the unknown-authority downgrade: while the scope
+ * reports `authority: 'unavailable'` — a contended, storage-failed or
+ * config-invalid registry publishes an empty deny set that is NOT evidence —
+ * `danger-full-access` executions run inside a primary-root-only
+ * profile (with the deny set applied) instead of ambient.
+ *
+ * Windows uses the standalone ambient deny-token runner. Landlock cannot subtract a subtree, so that combination selects bubblewrap.
+ * An unusable mount runner fails without starting an unconfined process.
+ *
+ * @module @dsh-electron/dsh-plugin-multi-root-workspace/process-fence
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;