@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.8

package/lib/workspace-files.js

@@ -1,11 +1,23 @@
-import { n as routeWorkspacePath, t as wrapMethod } from "./method-wrapper-Zc-JlDP3.js";
+import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
+import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {
 	return wrapMethod(service, "changes", (original) => original.length < 3 ? original : wrap(original));
 }
+/** Match both legacy `readRelated` and modern `readBytes({ baseFile })` tail resolution. */
+function resolveRelatedWorkspacePath(absoluteBase, tail) {
+	const paths = absoluteBase.startsWith("/") ? posix : win32;
+	return paths.resolve(paths.dirname(absoluteBase), tail.replace(/\\/g, "/"));
+}
 //#endregion
 //#region src/workspace-files.ts
-const inject = ["multiRootCompat", "multiRootScope"];
+const inject = [
+	"multiRootCompat",
+	"multiRootProviders",
+	"multiRootScope"
+];
 function apply(ctx) {
 	ctx.inject(["workspaceFiles", "fs"], (scope) => {
 		const service = scope.get("workspaceFiles");
@@ -22,13 +34,57 @@ function apply(ctx) {
 				if (!scope.multiRootScope.scopeOf(route.primaryRoot).includes(route.workspaceRoot)) throw await outside(path);
 				return result;
 			});
+			const restoreStat = wrapMethod(service, "stat", (original) => async function(request, path, signal) {
+				const routed = await routeRead(scope, request, path, signal);
+				if (routed === "deny") throw await outside(path);
+				return original.call(this, routed.request, routed.path, signal);
+			});
+			const restoreRead = wrapMethod(service, "read", (original) => async function(request, path, range, signal) {
+				const routed = await routeRead(scope, request, path, signal);
+				if (routed === "deny") throw await outside(path);
+				return original.call(this, routed.request, routed.path, range, signal);
+			});
+			const restoreReadBytes = wrapMethod(service, "readBytes", (original) => {
+				const call = original;
+				return (async function(request, path, options, signal) {
+					const baseFile = options?.baseFile;
+					if (baseFile !== void 0) {
+						const routed = await routeRead(scope, request, baseFile, signal);
+						if (routed === "deny") throw await outside(baseFile);
+						const escaped = await relatedTailWithheld(scope, request.workspaceRoot, routed, path, signal);
+						if (escaped !== void 0) throw await outside(escaped);
+						const routedOptions = baseFile === routed.path ? options : {
+							...options,
+							baseFile: routed.path
+						};
+						return call.call(this, routed.request, path, routedOptions, signal);
+					}
+					const routed = await routeRead(scope, request, path, signal);
+					if (routed === "deny") throw await outside(path);
+					return call.call(this, routed.request, routed.path, options, signal);
+				});
+			});
+			const legacy = service;
+			const restoreReadAll = typeof legacy.readAll === "function" ? wrapMethod(legacy, "readAll", (original) => (async function(request, path, signal) {
+				const routed = await routeRead(scope, request, path, signal);
+				if (routed === "deny") throw await outside(path);
+				return original.call(this, routed.request, routed.path, signal);
+			})) : void 0;
+			const restoreReadRelated = typeof legacy.readRelated === "function" ? wrapMethod(legacy, "readRelated", (original) => (async function(request, path, relativePath, signal) {
+				const routed = await routeRead(scope, request, path, signal);
+				if (routed === "deny") throw await outside(path);
+				const escaped = await relatedTailWithheld(scope, request.workspaceRoot, routed, relativePath, signal);
+				if (escaped !== void 0) throw await outside(escaped);
+				return original.call(this, routed.request, routed.path, relativePath, signal);
+			})) : void 0;
 			const restoreWatch = adaptPathWatch(service, (originalChanges) => async function* (request, path, signal) {
-				if (scope.multiRootScope.scopeOf(request.workspaceRoot).length === 0) {
+				if (scope.multiRootScope.scopeOf(request.workspaceRoot).length === 0 && registeredRoots(scope, request.workspaceRoot).length === 0) {
 					yield* originalChanges.call(this, request, path, signal);
 					return;
 				}
 				const route = await routeWorkspacePath(scope, request.workspaceRoot, path, signal);
 				if (route === void 0 || route.workspaceRoot === route.primaryRoot) {
+					if (underWithheldRoot(scope, request.workspaceRoot, path)) throw await outside(path);
 					yield* originalChanges.call(this, request, path, signal);
 					return;
 				}
@@ -55,11 +111,90 @@ function apply(ctx) {
 			return () => {
 				rowLifetime.abort(/* @__PURE__ */ new Error("multi-root workspace-files routing unloaded"));
 				restoreList();
+				restoreStat();
+				restoreRead();
+				restoreReadBytes();
+				restoreReadAll?.();
+				restoreReadRelated?.();
 				restoreWatch();
 			};
 		}, "multi-root:workspace-files routing");
 	});
 }
+/**
+* Route one read-style `workspaceFiles` call (`stat`/`read`/`readBytes`,
+* plus the legacy `readAll`/`readRelated` pair where a release has them).
+*
+* Upstream deliberately gives reads no workspace confinement, so the
+* multi-root boundary lives here: a path canonically inside a *live*
+* additional root is answered under that root's scope; a path lexically
+* inside a *registered but withheld* root is denied, because re-resolving it
+* would follow whatever replaced the registered directory — the grant must
+* never travel to a directory nobody registered. Anything else (primary
+* root, genuinely unrelated paths) keeps upstream's default read access.
+*/
+async function routeRead(scope, request, path, signal) {
+	if (scope.multiRootScope.scopeOf(request.workspaceRoot).length === 0 && registeredRoots(scope, request.workspaceRoot).length === 0) return {
+		request,
+		path
+	};
+	const route = await routeWorkspacePath(scope, request.workspaceRoot, path, signal);
+	if (route !== void 0 && route.workspaceRoot !== route.primaryRoot) {
+		if (!scope.multiRootScope.scopeOf(route.primaryRoot).includes(route.workspaceRoot)) return "deny";
+		return {
+			request: {
+				...request,
+				workspaceRoot: route.workspaceRoot
+			},
+			path: route.absolutePath
+		};
+	}
+	return underWithheldRoot(scope, request.workspaceRoot, path) ? "deny" : {
+		request,
+		path
+	};
+}
+/**
+* Every registration of one primary root, in any state — the scope only
+* publishes the effective grant, so the withheld set has to come from the
+* registry. Absent the registry service (degraded compositions, bare test
+* contexts) there is no withheld set to enforce.
+*/
+function registeredRoots(scope, primaryRoot) {
+	return scope.get("multiRootRegistry")?.list(primaryRoot) ?? [];
+}
+/**
+* Whether `path` lexically sits under a registered root that is not granted
+* right now. The comparison is lexical on purpose: the canonical resolution
+* of a withheld root escapes by definition (that is what `redirected` means),
+* so only the recorded spelling recognizes the stale row. `scopeOf` is the
+* grant authority — it re-validates `canonicalPath` on every call, so a
+* redirected root drops out even before the next registry `refresh()` run.
+*/
+function underWithheldRoot(scope, primaryRoot, path) {
+	const statuses = registeredRoots(scope, primaryRoot);
+	if (statuses.length === 0) return false;
+	const lexical = resolve(primaryRoot, path);
+	const candidates = statuses.filter((status) => isCanonicallyUnder(lexical, status.path));
+	if (candidates.length === 0) return false;
+	const granted = new Set(scope.multiRootScope.scopeOf(primaryRoot));
+	return candidates.some((status) => !granted.has(status.path));
+}
+/**
+* Resolve `tail` from the canonical base file's directory and report the joined path
+* when it lands under a withheld root. `readRelated`'s tail and `readBytes`'s
+* `baseFile`-relative target both read a file located relative to another
+* file, so the granted base must not reach back into a dead grant.
+*/
+async function relatedTailWithheld(scope, primaryRoot, base, tail, signal) {
+	if (registeredRoots(scope, primaryRoot).length === 0) return void 0;
+	const targetBase = await scope.fs.resolve(base.path, {
+		cwd: base.request.workspaceRoot,
+		signal
+	});
+	const target = resolveRelatedWorkspacePath(scope.fs.processPath(targetBase), tail);
+	return underWithheldRoot(scope, primaryRoot, target) ? target : void 0;
+}
 async function outside(path) {
 	const { RemoteError } = await import("@deepseek-ai/dsh-typert-protocol");
 	return new RemoteError("workspace-file/outside-workspace", `"${path}" is no longer in this workspace`, { path });

package/lib/workspace-routing-YPxaQ4V3.js

@@ -0,0 +1,26 @@
+import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
+//#region src/workspace-routing.ts
+/** Resolve relative paths against the primary cwd; never search other roots by basename. */
+async function routeWorkspacePath(ctx, primaryRoot, path, signal, cwd = primaryRoot) {
+	signal?.throwIfAborted();
+	const primary = canonicalPath(primaryRoot);
+	const roots = [primary, ...ctx.multiRootScope.scopeOf(primary)];
+	const target = await ctx.fs.resolve(path, {
+		cwd,
+		...signal === void 0 ? {} : { signal }
+	});
+	for (const root of roots) {
+		const rootTarget = await ctx.fs.resolve(root, signal === void 0 ? {} : { signal });
+		if (!ctx.fs.contains(rootTarget, target)) continue;
+		if (root !== primary && !ctx.multiRootScope.scopeOf(primary).includes(root)) return void 0;
+		signal?.throwIfAborted();
+		return {
+			primaryRoot: primary,
+			workspaceRoot: root,
+			target,
+			absolutePath: ctx.fs.processPath(target)
+		};
+	}
+}
+//#endregion
+export { routeWorkspacePath as t };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -30,6 +30,10 @@
       "types": "./lib/types/registry.d.ts",
       "default": "./lib/registry.js"
     },
+    "./providers": {
+      "types": "./lib/types/providers.d.ts",
+      "default": "./lib/providers.js"
+    },
     "./instructions": {
       "types": "./lib/types/instructions.d.ts",
       "default": "./lib/instructions.js"
@@ -51,6 +55,10 @@
       "types": "./lib/types/workspace-files.d.ts",
       "default": "./lib/workspace-files.js"
     },
+    "./process-fence": {
+      "types": "./lib/types/process-fence.d.ts",
+      "default": "./lib/process-fence.js"
+    },
     "./windows-runner": {
       "types": "./lib/types/windows-runner.d.ts",
       "default": "./lib/windows-runner.js"
@@ -65,7 +73,9 @@
     "README.en.md",
     "CHANGELOG.md",
     "CHANGELOG.en.md",
-    "LICENSE"
+    "LICENSE",
+    "scripts/windows-broker/*.ps1",
+    "scripts/windows-broker/*.cs"
   ],
   "publishConfig": {
     "access": "public"
@@ -79,27 +89,27 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0 || 4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-agent-instructions": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-fs": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-storage-domain": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-lsp": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-lsp-stdio": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-workspace-files": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-windows-acl": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2"
+    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0 || 4.0.5-alpha.1 || 4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-instructions": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-workspace-files": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-lsp": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-lsp-stdio": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-windows-acl": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent": {
@@ -146,39 +156,54 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5-alpha.1",
-    "@deepseek-ai/dsh": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-agent-instructions": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-base": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-workspace": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-commands": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-storage": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-storage-domain": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-storage-json": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-workspace": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-instructions": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-base": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-store": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-dockkit": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-open-in-app": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-lsp": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-lsp-stdio": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-windows-acl": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage-json": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-workspace-path": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-workspace": "0.2.1-rc.2",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.31",
+    "@types/react-dom": "~18.3.7",
     "clsx": "^2.0.0",
+    "immer": "^10.2.0",
     "jsdom": "^29.1.1",
     "oxlint": "^1.76.0",
     "react": "^18.3.1",
@@ -187,13 +212,7 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.8",
     "yaml": "^2.9.0",
-    "@deepseek-ai/dsh-lsp": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-lsp-stdio": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-workspace-files": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-sandbox-windows-acl": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.2"
+    "zustand": "~4.5.7"
   },
   "dsh": {
     "bundle": {
@@ -210,11 +229,12 @@
     }
   },
   "dependencies": {
-    "zod": "^4.6.2",
     "@deepseek-ai/node-addon-system": "^0.1.2",
-    "koffi": "^3.1.0"
+    "koffi": "^3.1.0",
+    "zod": "^4.6.2"
   },
   "scripts": {
+    "bench:roots": "node --experimental-transform-types scripts/bench-root-scale.mjs",
     "build": "pnpm run build:types && pnpm run bundle",
     "build:types": "tsc -p tsconfig.host.json && tsc -p tsconfig.client.json",
     "bundle": "node scripts/clean-lib.mjs && tsdown",
@@ -223,13 +243,15 @@
     "kernel:probe": "node scripts/check-kernel-runner.mjs",
     "lint": "oxlint",
     "release": "node scripts/bump-version.mjs",
+    "pack:check": "node scripts/check-pack.mjs",
     "smoke": "pnpm smoke:compose && pnpm smoke:behavior && pnpm smoke:journey",
     "smoke:behavior": "node scripts/smoke-behavior.mjs",
     "smoke:compose": "node scripts/smoke-compose.mjs",
     "smoke:journey": "node scripts/smoke-journey.mjs",
+    "smoke:packed": "node scripts/smoke-packed.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.host.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke"
+    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke && pnpm pack:check && pnpm smoke:packed"
   }
 }

package/scripts/windows-broker/install.ps1

@@ -0,0 +1,89 @@
+# Run from an elevated PowerShell. A dedicated virtual service account
+# authenticates one installation SID; its executable is administrator-owned.
+[CmdletBinding()]
+param([string]$UserSid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value, [switch]$Uninstall)
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not ([Security.Principal.WindowsPrincipal]::new($identity)).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this installer in an elevated PowerShell.'
+}
+$sid = [Security.Principal.SecurityIdentifier]::new($UserSid).Value
+$sha = [Security.Cryptography.SHA256]::Create()
+try { $hash = ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($sid)))).Replace('-', '').ToLower().Substring(0,16) }
+finally { $sha.Dispose() }
+$name = "DshMultiRootBroker-$hash"
+$directory = Join-Path $env:ProgramFiles $name
+$sc = Join-Path $env:SystemRoot 'System32/sc.exe'
+# Virtual service SIDs are deterministic and do not require a user password.
+$serviceSidText = (& $sc showsid $name | Out-String)
+if ($LASTEXITCODE -ne 0) { throw 'Cannot resolve broker service SID.' }
+$serviceSid = [regex]::Match($serviceSidText, 'S-1-5-80-(?:[0-9]+-){4}[0-9]+').Value
+if (-not $serviceSid) { throw 'Missing broker service SID.' }
+if (-not ('DshBrokerRights' -as [type])) { Add-Type -Path (Join-Path $PSScriptRoot 'rights.cs') }
+$rightsRecord = Join-Path $directory 'added-rights.json'
+$service = Get-Service -Name $name -ErrorAction SilentlyContinue
+if ($service) { Stop-Service $name -Force; & $sc delete $name | Out-Null; if ($LASTEXITCODE -ne 0) { throw 'Cannot remove previous broker service.' }; Start-Sleep -Milliseconds 500 }
+# Revoke only rights this installer added; preserve pre-existing account policy.
+if (Test-Path $rightsRecord) {
+    # Windows PowerShell 5.1 emits the JSON array as a single object; cast the
+    # result value directly (not inside @(...)) so it yields one element per
+    # recorded right.
+    [DshBrokerRights]::Remove($serviceSid, [string[]](Get-Content -Raw $rightsRecord | ConvertFrom-Json))
+    Remove-Item $rightsRecord -Force
+}
+if ($Uninstall) { if (Test-Path $directory) { Remove-Item $directory -Recurse -Force }; Write-Output "Removed $name"; return }
+New-Item -ItemType Directory -Path $directory -Force | Out-Null
+# The installed code and directory must never be writable by the client user.
+$acl = [Security.AccessControl.DirectorySecurity]::new()
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($trustee in @('S-1-5-18', 'S-1-5-32-544')) {
+    $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($trustee), 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+}
+$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($serviceSid), 'ReadAndExecute', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid), 'ReadAndExecute', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+$acl.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))
+Set-Acl -LiteralPath $directory -AclObject $acl
+$exe = Join-Path $directory 'broker.exe'
+if (Test-Path $exe) { Remove-Item $exe -Force }
+$framework = Join-Path $env:SystemRoot 'Microsoft.NET/Framework64/v4.0.30319'
+$compiler = Join-Path $framework 'csc.exe'
+& $compiler /nologo /target:exe /platform:anycpu "/out:$exe" "/reference:$(Join-Path $framework 'System.ServiceProcess.dll')" (Join-Path $PSScriptRoot 'service.cs')
+if ($LASTEXITCODE -ne 0) { throw 'Broker compilation failed.' }
+$pendingRecord = "$rightsRecord.pending"
+$addedRights = [string[]]@()
+$serviceCreated = $false
+try {
+    & $sc create $name binPath= "`"$exe`" $sid $name" start= auto obj= "NT SERVICE\$name" | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw 'Broker service registration failed.' }
+    $serviceCreated = $true
+    $addedRights = [DshBrokerRights]::Install($serviceSid)
+    # Publish a complete record; a failed write must not leave malformed JSON
+    # on the upgrade/uninstall path.
+    ConvertTo-Json -InputObject @($addedRights) | Set-Content -LiteralPath $pendingRecord
+    Move-Item -LiteralPath $pendingRecord -Destination $rightsRecord -Force
+    Start-Service $name
+    (Get-Service $name).WaitForStatus('Running', [TimeSpan]::FromSeconds(15))
+} catch {
+    $installationError = $_
+    try {
+        if ($serviceCreated) {
+            $failedService = Get-Service -Name $name -ErrorAction SilentlyContinue
+            if ($failedService -and $failedService.Status -ne 'Stopped') { Stop-Service $name -Force }
+        }
+    } finally {
+        try {
+            # Revoke exactly this attempt's additions even if stopping fails.
+            # Remove the record only AFTER successful revocation.
+            [DshBrokerRights]::Remove($serviceSid, $addedRights)
+            Remove-Item -LiteralPath $pendingRecord -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $rightsRecord -Force -ErrorAction SilentlyContinue
+        } finally {
+            if ($serviceCreated) {
+                & $sc delete $name | Out-Null
+                if ($LASTEXITCODE -ne 0) { throw 'Cannot roll back failed broker service registration.' }
+            }
+        }
+    }
+    throw $installationError
+}
+Write-Output "Installed $name for $sid"

package/scripts/windows-broker/rights.cs

@@ -0,0 +1,58 @@
+// Installer-only LSA policy adapter. This code never runs in the broker or
+// accepts rights chosen by a client. Only the dedicated service SID is valid.
+using System;
+using System.ComponentModel;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Text.RegularExpressions;
+
+public static class DshBrokerRights {
+    static readonly string[] Required = { "SeServiceLogonRight", "SeCreateTokenPrivilege", "SeAssignPrimaryTokenPrivilege", "SeTcbPrivilege", "SeDebugPrivilege", "SeImpersonatePrivilege" };
+    public static string[] Install(string serviceSid) { return Change(serviceSid, null); }
+    public static void Remove(string serviceSid, string[] added) { Change(serviceSid, added); }
+    static string[] Change(string serviceSid, string[] remove) {
+        if (!Regex.IsMatch(serviceSid, @"^S-1-5-80-(?:[0-9]+-){4}[0-9]+$")) throw new ArgumentException("Expected dedicated service SID");
+        var identity = new SecurityIdentifier(serviceSid); var sid = new byte[identity.BinaryLength]; identity.GetBinaryForm(sid, 0);
+        var attributes = new ObjectAttributes { Length = Marshal.SizeOf(typeof(ObjectAttributes)) };
+        IntPtr policy; Check(LsaOpenPolicy(IntPtr.Zero, ref attributes, 0x810, out policy), "LsaOpenPolicy");
+        try {
+            var current = new HashSet<string>(StringComparer.Ordinal);
+            IntPtr list; uint count;
+            uint status = LsaEnumerateAccountRights(policy, sid, out list, out count);
+            if (status != 0xC0000034) {
+                Check(status, "LsaEnumerateAccountRights");
+                try {
+                    if (count > 128) throw new ArgumentException("Invalid rights count");
+                    for (int i = 0; i < count; i++) {
+                        var item = (UnicodeString)Marshal.PtrToStructure(IntPtr.Add(list, i * Marshal.SizeOf(typeof(UnicodeString))), typeof(UnicodeString));
+                        current.Add(Marshal.PtrToStringUni(item.Buffer, item.Length / 2));
+                    }
+                } finally { LsaFreeMemory(list); }
+            }
+            var changes = new List<string>();
+            foreach (var right in remove ?? Required) {
+                if (Array.IndexOf(Required, right) < 0) throw new ArgumentException("Unexpected broker right");
+                if (remove == null ? !current.Contains(right) : current.Contains(right)) changes.Add(right);
+            }
+            if (changes.Count == 0) return changes.ToArray();
+            var values = new UnicodeString[changes.Count];
+            try {
+                for (int i = 0; i < values.Length; i++) values[i] = new UnicodeString { Length = checked((ushort)(changes[i].Length * 2)), MaximumLength = checked((ushort)(changes[i].Length * 2 + 2)), Buffer = Marshal.StringToHGlobalUni(changes[i]) };
+                Check(remove == null ? LsaAddAccountRights(policy, sid, values, (uint)values.Length)
+                    : LsaRemoveAccountRights(policy, sid, false, values, (uint)values.Length), "Broker account rights");
+            } finally { foreach (var value in values) if (value.Buffer != IntPtr.Zero) Marshal.FreeHGlobal(value.Buffer); }
+            return changes.ToArray();
+        } finally { LsaClose(policy); }
+    }
+    static void Check(uint code, string name) { if (code != 0) throw new Win32Exception((int)LsaNtStatusToWinError(code), name); }
+    [StructLayout(LayoutKind.Sequential)] struct UnicodeString { public ushort Length, MaximumLength; public IntPtr Buffer; }
+    [StructLayout(LayoutKind.Sequential)] struct ObjectAttributes { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
+    [DllImport("advapi32.dll")] static extern uint LsaOpenPolicy(IntPtr system, ref ObjectAttributes attributes, uint access, out IntPtr policy);
+    [DllImport("advapi32.dll")] static extern uint LsaEnumerateAccountRights(IntPtr policy, byte[] sid, out IntPtr rights, out uint count);
+    [DllImport("advapi32.dll")] static extern uint LsaAddAccountRights(IntPtr policy, byte[] sid, UnicodeString[] rights, uint count);
+    [DllImport("advapi32.dll")] static extern uint LsaRemoveAccountRights(IntPtr policy, byte[] sid, [MarshalAs(UnmanagedType.U1)] bool all, UnicodeString[] rights, uint count);
+    [DllImport("advapi32.dll")] static extern uint LsaNtStatusToWinError(uint status);
+    [DllImport("advapi32.dll")] static extern uint LsaFreeMemory(IntPtr memory);
+    [DllImport("advapi32.dll")] static extern uint LsaClose(IntPtr policy);
+}