@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.8

package/lib/contract-DZ4zczDT.js

@@ -0,0 +1,238 @@
+import { z } from "zod";
+//#region src/contract.ts
+/**
+* The wire contract between the browser panel and this plugin's host half.
+*
+* It is deliberately transport-agnostic plain data: the host registers one
+* Connection RPC channel (see `command.ts`) and the client bundle inlines this
+* module, so both sides agree on endpoint names and payload shapes without
+* sharing any runtime identity. Error codes are the stable half of the
+* contract; `message` is only a fallback the panel does not have to show.
+*
+* Two properties this module owns:
+*
+* - **One shape per endpoint.** {@link PanelResponseMap} is the single mapping
+*   from endpoint to response type, so the panel cannot silently decode one
+*   endpoint's answer as another's. `reveal` answers with
+*   {@link RevealedView}; root-management endpoints answer with
+*   {@link RootsView}.
+*   The host builds those answers in `command.ts` and the
+*   panel parses them here — one definition, two consumers.
+* - **Runtime validation at the boundary.** The payload arrives from a browser
+*   and the answer arrives from the host; neither is trusted to match the
+*   TypeScript types. {@link parsePanelCall} and the `parse*View` functions
+*   check the shapes and report structural failures as a message, so a
+*   mismatch becomes a visible, localized error instead of a crash or a
+*   silently wrong render.
+*
+* Nothing here may import `node:*` or `@deepseek-ai/*`: this module is inlined
+* into the browser bundle.
+*
+* @module @dsh-electron/dsh-plugin-multi-root-workspace/contract
+*/
+/** The absolute logical channel both halves speak over. */
+const PANEL_CHANNEL = "/multi-root-workspace";
+/** Every endpoint name, for exhaustive iteration in tests and callers. */
+const PANEL_ENDPOINTS = [
+	"list",
+	"add",
+	"remove",
+	"alias",
+	"move",
+	"setAccess",
+	"reveal"
+];
+/** The shared nine-cell rule; tool dispatch may subsequently narrow writes. */
+function effectiveRootAccess(access, mode) {
+	if (access !== "inherit") return access;
+	return mode === "danger-full-access" ? "full-access" : mode === "workspace-write" ? "read-write" : "read-only";
+}
+/**
+* The request body on the wire. The endpoint travels as the RPC method, not as
+* a field, so this schema covers the fields only; the host pairs it with the
+* method the channel dispatched (and rejects the pair if the body contradicts
+* it). Unknown keys are rejected rather than ignored: a client sending a field
+* this host does not understand is out of contract, and silently dropping it
+* would hide the drift.
+*/
+const panelRequestSchema = z.object({
+	sessionId: z.string().min(1),
+	entry: z.object({
+		ordinal: z.number().int().positive(),
+		id: z.string(),
+		path: z.string(),
+		addedAt: z.string()
+	}).strict().optional(),
+	id: z.string().optional(),
+	path: z.string().optional(),
+	alias: z.string().optional(),
+	access: z.enum([
+		"inherit",
+		"read-write",
+		"read-only"
+	]).optional(),
+	beforeEntry: z.object({
+		ordinal: z.number().int().positive(),
+		id: z.string(),
+		path: z.string(),
+		addedAt: z.string()
+	}).strict().optional(),
+	beforeId: z.string().optional()
+}).strict();
+/**
+* One root as it travels over the channel. Deliberately NOT strict, in both
+* directions: a newer host that adds a field must not brick an older panel, and
+* the field that matters is the state it reports.
+*/
+const rootViewSchema = z.object({
+	ordinal: z.number().int().positive(),
+	id: z.string(),
+	path: z.string(),
+	alias: z.string().optional(),
+	addedAt: z.string(),
+	state: z.enum([
+		"available",
+		"missing",
+		"redirected",
+		"invalid"
+	]),
+	access: z.enum([
+		"inherit",
+		"read-write",
+		"read-only"
+	]).optional(),
+	detail: z.string().optional(),
+	effectiveAccess: z.enum([
+		"read-only",
+		"read-write",
+		"full-access",
+		"unavailable"
+	]).optional()
+});
+const rootsViewSchema = z.object({
+	primaryRoot: z.string(),
+	primaryName: z.string().optional(),
+	effectiveCwd: z.string().optional(),
+	mode: z.enum([
+		"read-only",
+		"workspace-write",
+		"danger-full-access"
+	]).optional(),
+	cappedTools: z.array(z.string()).optional(),
+	toolAccessInvalid: z.boolean().optional(),
+	roots: z.array(rootViewSchema),
+	limit: z.number().int().nonnegative().optional(),
+	count: z.number().int().nonnegative().optional(),
+	unavailable: z.string().optional()
+});
+const revealedViewSchema = z.object({ revealed: z.string() });
+z.object({
+	code: z.string(),
+	message: z.string(),
+	details: z.unknown().optional()
+});
+/**
+* Validate the payload the host received for one endpoint.
+* @param endpoint - the endpoint the channel dispatched (the RPC method).
+* @param payload - the raw channel payload (the request body).
+* @returns the call the host may act on, or the reason it is not one.
+*/
+function parsePanelCall(endpoint, payload) {
+	if (!PANEL_ENDPOINTS.includes(endpoint)) return {
+		ok: false,
+		message: `unknown endpoint "${endpoint}"`
+	};
+	const parsed = panelRequestSchema.safeParse(payload ?? {});
+	if (!parsed.success) return {
+		ok: false,
+		message: `the request body is invalid: ${firstIssue(parsed.error)}`
+	};
+	return {
+		ok: true,
+		value: narrowCall(endpoint, parsed.data)
+	};
+}
+/**
+* Validate a `RootsView` when it arrives.
+* @param value - the raw endpoint value.
+* @returns the view, or the reason it is not one.
+*/
+function parseRootsView(value) {
+	const parsed = rootsViewSchema.safeParse(value);
+	if (!parsed.success) return {
+		ok: false,
+		message: `the answer is not a roots view: ${firstIssue(parsed.error)}`
+	};
+	const view = parsed.data;
+	return {
+		ok: true,
+		value: {
+			primaryRoot: view.primaryRoot,
+			...view.primaryName === void 0 ? {} : { primaryName: view.primaryName },
+			...view.effectiveCwd === void 0 ? {} : { effectiveCwd: view.effectiveCwd },
+			...view.mode === void 0 ? {} : { mode: view.mode },
+			...view.cappedTools === void 0 ? {} : { cappedTools: view.cappedTools },
+			...view.toolAccessInvalid === void 0 ? {} : { toolAccessInvalid: view.toolAccessInvalid },
+			roots: view.roots.map(narrowRootView),
+			limit: view.limit ?? Number.MAX_SAFE_INTEGER,
+			count: view.count ?? view.roots.length,
+			...view.unavailable === void 0 ? {} : { unavailable: view.unavailable }
+		}
+	};
+}
+/**
+* Validate a `RevealedView` when it arrives.
+* @param value - the raw endpoint value.
+* @returns the view, or the reason it is not one.
+*/
+function parseRevealedView(value) {
+	const parsed = revealedViewSchema.safeParse(value);
+	if (!parsed.success) return {
+		ok: false,
+		message: `the answer is not a reveal result: ${firstIssue(parsed.error)}`
+	};
+	return {
+		ok: true,
+		value: parsed.data
+	};
+}
+/**
+* Rebuild a parsed call as the declared type, keeping absent optional fields
+* ABSENT (`exactOptionalPropertyTypes` distinguishes "absent" from "undefined",
+* and the host's own code reads the two the same way the panel sent them).
+*/
+function narrowCall(endpoint, value) {
+	return {
+		endpoint,
+		sessionId: value.sessionId,
+		...value.entry === void 0 ? {} : { entry: value.entry },
+		...value.id === void 0 ? {} : { id: value.id },
+		...value.path === void 0 ? {} : { path: value.path },
+		...value.alias === void 0 ? {} : { alias: value.alias },
+		...value.access === void 0 ? {} : { access: value.access },
+		...value.beforeEntry === void 0 ? {} : { beforeEntry: value.beforeEntry },
+		...value.beforeId === void 0 ? {} : { beforeId: value.beforeId }
+	};
+}
+/** Rebuild one parsed root as the declared `RootView`. */
+function narrowRootView(value) {
+	return {
+		ordinal: value.ordinal,
+		id: value.id,
+		path: value.path,
+		addedAt: value.addedAt,
+		state: value.state,
+		access: value.access ?? "inherit",
+		...value.effectiveAccess === void 0 ? {} : { effectiveAccess: value.effectiveAccess },
+		...value.alias === void 0 ? {} : { alias: value.alias },
+		...value.detail === void 0 ? {} : { detail: value.detail }
+	};
+}
+/** Render the first zod issue as one short sentence. */
+function firstIssue(error) {
+	const issue = error.issues[0];
+	if (issue === void 0) return "invalid";
+	return `${issue.path.length === 0 ? "" : `${issue.path.join(".")}: `}${issue.message}`;
+}
+//#endregion
+export { parseRevealedView as a, parsePanelCall as i, PANEL_ENDPOINTS as n, parseRootsView as o, effectiveRootAccess as r, PANEL_CHANNEL as t };

package/lib/{fs-D_Sw3o5z.js → fs-Nlp2AiRX.js}

@@ -1,3 +1,4 @@
+import { brandMultiRootProvider } from "./providers.js";
 import { dirname, sep } from "node:path";
 import { writableRoots } from "@deepseek-ai/dsh-sandbox";
 import { FsError } from "@deepseek-ai/dsh-fs";
@@ -64,14 +65,11 @@ async function isPathUnder(path, root, caseSensitive = process.platform !== "win
 * roots.
 */
 var MultiRootFileSystem = class extends LocalFileSystem {
-	static inject = [
-		"multiRootCompat",
-		"sandboxPolicy",
-		"multiRootScope"
-	];
+	static inject = ["sandboxPolicy", "multiRootScope"];
 	defaultMode;
 	constructor(ctx, config) {
 		super(ctx, config);
+		brandMultiRootProvider(this, "fs");
 		this.defaultMode = ctx.sandboxPolicy.defaultMode;
 	}
 	/** The deployment default mode — the capability fact the tool layer reads to advertise escalation. */
@@ -107,47 +105,81 @@ var MultiRootFileSystem = class extends LocalFileSystem {
 		return super.editText(await this.checkedTarget(target, sandboxPolicy), edit, expected, signal);
 	}
 	/**
-	* The writable roots of one workspace-write call: the upstream derivation
-	* (primary root plus the platform temp areas, canonical and deduplicated)
-	* widened by the scope's additional roots, in scope order.
+	* The writable roots of one confined call: the upstream derivation (primary
+	* root plus the platform temp areas, canonical and deduplicated — empty
+	* under `read-only`) widened by the scope's EFFECTIVE writable members.
+	* Under `read-only` that is exactly the fixed `read-write` roots (the tool
+	* cap may already have emptied the scope's list), so an explicit grant
+	* survives a globally read-only session. An unavailable registry authority
+	* never contributes members: a process that cannot read the store grants
+	* only the primary root (and no shared temp grant).
 	* @param policy - the per-call policy.
 	* @param scope - the scope resolved once for this call; both the fence and
 	*   the denial message below share it instead of re-resolving.
-	* @returns the canonical writable roots; empty under `read-only`.
+	* @returns the canonical writable roots; possibly empty.
 	*/
 	rootsFor(policy, scope) {
+		if (scope.authority === "unavailable") return policy.mode === "read-only" ? [] : [scope.primaryRoot];
 		const roots = writableRoots(policy);
-		if (roots.length === 0) return roots;
-		for (const root of scope.additionalRoots) if (!roots.includes(root)) roots.push(root);
+		for (const root of scope.writableRoots) if (!roots.includes(root)) roots.push(root);
 		return roots;
 	}
 	/**
-	* Enforce the per-call policy against `target` and return the EXACT target the
-	* mutation must use, so the checked identity is the mutated one (no
-	* check-here-write-there TOCTOU). `read-only` denies; `workspace-write`
-	* re-canonicalizes NOW (reflecting a concurrently swapped symlink ancestor),
-	* requires containment under one of the scope's writable roots, and returns
-	* THAT fresh target; `danger-full-access` returns the caller's target unfenced.
+	* Enforce the per-call policy against `target` and return the EXACT target
+	* the mutation must use, so the checked identity is the mutated one (no
+	* check-here-write-there TOCTOU). Deny precedes containment: a root in
+	* `scope.deniedRoots` — an explicit `read-only` root, or any member when the
+	* call is tool-capped — refuses writes under EVERY mode, including
+	* `danger-full-access` and where a broader grant (the platform temp area)
+	* would otherwise cover the path. `read-only` then grants only the fixed
+	* `read-write` members; `workspace-write` requires containment under the
+	* widened writable set.
+	*
+	* `danger-full-access` is the only mode with a fast path, and only while
+	* the deny set is empty: it then returns the caller's target untouched,
+	* upstream-exact. Once ANY deny boundary exists the caller's `FsTarget` may
+	* be stale — the directory it resolved through can since have been replaced
+	* by a symlink into a denied root — so the fence re-resolves
+	* `target.displayPath`, checks the FRESH target key, and mutates that fresh
+	* target rather than the stale one the caller resolved earlier.
+	*
+	* One more Full-access rule: while the registry authority is `unavailable`
+	* the empty deny set is not trustworthy — the store this process cannot
+	* read may hold explicit `read-only` registrations — so the mode degrades
+	* to primary-root-only writes (no shared temp or additional-root grants)
+	* until the authority returns.
 	* @param target - the resolved target about to be mutated.
 	* @param sandboxPolicy - the per-call policy; omit for the deployment fallback.
 	* @returns the fresh canonical target the mutation must use.
 	*/
 	async checkedTarget(target, sandboxPolicy) {
 		const policy = sandboxPolicy ?? this.ctx.sandboxPolicy.resolve();
-		const { mode } = policy;
-		if (mode === "danger-full-access") return target;
-		if (mode === "read-only") throw new FsError(`cannot write "${target.displayPath}": file access denied under read-only mode`, "FS_SANDBOX_DENIED");
-		const fresh = await this.resolve(target.displayPath);
 		const scope = this.ctx.multiRootScope.resolve(policy);
-		const roots = this.rootsFor(policy, scope);
+		const effectiveMode = scope.authority === "unavailable" && policy.mode === "danger-full-access" ? "workspace-write" : policy.mode;
+		if (effectiveMode === "danger-full-access" && scope.deniedRoots.length === 0) return target;
+		const fresh = await this.resolve(target.displayPath);
+		if (scope.deniedRoots.length > 0) {
+			for (const path of scope.deniedRoots) if (await isPathUnder(fresh.targetKey, path)) {
+				const root = scope.roots.find((root) => root.path === path);
+				const reason = path === scope.protectedHome ? `${path} is the DSH home directory, which is protected under danger-full-access while workspace restrictions apply` : root?.access === "read-only" || root === void 0 ? `${path} is a read-only additional root` : `${path} is an additional root this call may not write`;
+				throw new FsError(`cannot write "${target.displayPath}": ${reason}`, "FS_SANDBOX_DENIED");
+			}
+		}
+		if (effectiveMode === "danger-full-access") return fresh;
+		const effectivePolicy = {
+			...policy,
+			mode: effectiveMode
+		};
+		const roots = this.rootsFor(effectivePolicy, scope);
 		let contained = false;
 		for (const root of roots) if (await isPathUnder(fresh.targetKey, root)) {
 			contained = true;
 			break;
 		}
 		if (!contained) {
-			const denial = `cannot write "${target.displayPath}": file access denied under workspace-write mode`;
-			throw new FsError(scope.additionalRoots.length === 0 ? denial : `${denial}; allowed roots: ${roots.join(", ")}`, "FS_SANDBOX_DENIED");
+			let denial = `cannot write "${target.displayPath}": file access denied under ${effectiveMode} mode`;
+			if (scope.additionalRoots.length > 0) denial += `; allowed roots: ${roots.join(", ")}`;
+			throw new FsError(denial, "FS_SANDBOX_DENIED");
 		}
 		return fresh;
 	}

package/lib/fs.js

@@ -1,2 +1,3 @@
-import { t as MultiRootFileSystem } from "./fs-D_Sw3o5z.js";
+import "./providers.js";
+import { t as MultiRootFileSystem } from "./fs-Nlp2AiRX.js";
 export { MultiRootFileSystem, MultiRootFileSystem as default };

package/lib/index.js

@@ -1,11 +1,13 @@
-import { c as REQUIRED_CORE_PACKAGES, d as compatEnforcement, f as readInstalledVersion, i as assertSupportedInstallation, l as SUPPORTED_DSH_RELEASES, n as MultiRootCompatService, o as CORE_PACKAGES, s as OPTIONAL_CORE_PACKAGES, t as DshCompatUnsupportedError, u as classifyInstallation } from "./compat-B6ZqbQBy.js";
-import { a as composeInstructionMessage, c as createInstructionMessage, l as instructionsApi, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES, u as renderInstructions } from "./instructions-DfzN-wVf.js";
-import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-BRXl_FpF.js";
-import { a as classifyStoredRoots, c as indexedStatuses, f as resolveRootRef, i as canonicalRoot, l as isCanonicallyUnder, n as additionalRootId, p as validateRootCandidate, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-DasWEBJk.js";
-import { t as MultiRootFileSystem } from "./fs-D_Sw3o5z.js";
+import { _ as classifyInstallation, c as agentPtyMarkerVerdict, d as HOST_SERVICE_PACKAGES, f as OPTIONAL_CORE_PACKAGES, g as SUPPORTED_DSH_RELEASES, h as RUNTIME_OPTIONAL_PACKAGES, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as RUNNER_ANCHORED_PACKAGES, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as REQUIRED_CORE_PACKAGES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES, v as compatEnforcement, y as readInstalledVersion } from "./compat-DR2LvmYZ.js";
+import { a as composeInstructionMessage, c as createInstructionMessage, l as instructionsApi, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES, u as renderInstructions } from "./instructions-D19jRxN0.js";
+import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-CVAcT_gy.js";
+import { a as classifyStoredRoots, c as indexedStatuses, i as canonicalRoot, l as isCanonicallyUnder, m as validateRootCandidate, n as additionalRootId, p as resolveRootRef, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-B-0l8mNG.js";
+import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
+import { t as MultiRootFileSystem } from "./fs-Nlp2AiRX.js";
+import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-DZ4zczDT.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
-import { c as RegistryLeaseContendedError, i as REGISTRY_CONTENDED_MESSAGE, n as MAX_ALIAS_LENGTH, o as multiRootDomainSpec, r as MultiRootRegistry, s as RegistryAuthorityLease, t as DOMAIN_NAME } from "./registry-DySMbjgW.js";
-import { a as renderRootsReport, c as PANEL_CHANNEL, d as parseFilesView, f as parsePanelCall, i as parseFoldersCommand, l as PANEL_ENDPOINTS, m as parseRootsView, o as resolvePanelPrimaryRoot, p as parseRevealedView, s as revealArgv, t as COMMAND_NAME, u as parseFilePreview } from "./command-CTdNvwt1.js";
+import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-DCxC5Lay.js";
+import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as resolvePanelPrimaryRoot, t as COMMAND_NAME } from "./command-CESuwlVt.js";
 //#region src/index.ts
 /**
 * Carrier plugin face for the bare-package-name loader row (see the module
@@ -16,4 +18,4 @@ import { a as renderRootsReport, c as PANEL_CHANNEL, d as parseFilesView, f as p
 const inject = [];
 function apply() {}
 //#endregion
-export { COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, MAX_ALIAS_LENGTH, MultiRootCompatService, MultiRootFileSystem, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, apply, assertSupportedInstallation, availableRoots, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, multiRootDomainSpec, parseFilePreview, parseFilesView, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };
+export { AGENT_PTY_MARKER, COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_ADDITIONAL_ROOTS, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, HOST_SERVICE_PACKAGES, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MULTI_ROOT_PROVIDER_BRAND, MultiRootCompatService, MultiRootFileSystem, MultiRootProviders, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, PtyMarkerContractError, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RUNNER_ANCHORED_PACKAGES, RUNTIME_OPTIONAL_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, agentPtyMarkerVerdict, apply, assertAgentPtyMarker, assertSupportedInstallation, availableRoots, brandMultiRootProvider, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, isMultiRootProvider, multiRootDomainSpec, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };

package/lib/{instructions-DfzN-wVf.js → instructions-D19jRxN0.js}

@@ -1,11 +1,11 @@
 import { t as effectiveDirectory } from "./session-directory-BLOstut1.js";
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
-import { l as isCanonicallyUnder } from "./roots-DasWEBJk.js";
+import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
 import { createRequire } from "node:module";
 import "@deepseek-ai/cordis";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
 //#region src/compat/agent-instructions.ts
 /**
@@ -430,6 +430,7 @@ function composeInstructionMessage(rendered, revoked, removed) {
 /** This row is gated on the compatibility contract like every other provider. */
 const inject = [
 	"multiRootCompat",
+	"multiRootProviders",
 	"multiRootScope",
 	"sandboxPolicy"
 ];

package/lib/instructions.js

@@ -1,2 +1,2 @@
-import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-DfzN-wVf.js";
+import { a as composeInstructionMessage, i as apply, n as DEFAULT_MAX_SOURCE_BYTES, o as inject, r as PLUGIN_SOURCE, s as touchedPathOfToolCall, t as DEFAULT_MAX_BYTES } from "./instructions-D19jRxN0.js";
 export { DEFAULT_MAX_BYTES, DEFAULT_MAX_SOURCE_BYTES, PLUGIN_SOURCE, apply, composeInstructionMessage, inject, touchedPathOfToolCall };

package/lib/lsp.js

@@ -1,8 +1,13 @@
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
-import { n as routeWorkspacePath, t as wrapMethod } from "./method-wrapper-Zc-JlDP3.js";
+import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
+import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/lsp.ts
-const inject = ["multiRootCompat", "multiRootScope"];
+const inject = [
+	"multiRootCompat",
+	"multiRootProviders",
+	"multiRootScope"
+];
 function apply(ctx) {
 	const callers = new AsyncLocalStorage();
 	aroundTool(ctx, (exec, next) => exec.agent === void 0 ? next() : callers.run(exec.agent.session, next));

package/lib/method-wrapper-CFY3p3j2.js

@@ -0,0 +1,26 @@
+//#region src/method-wrapper.ts
+/** Wrap a public method on a Cordis service without capturing a caller-context proxy. */
+function wrapMethod(target, key, wrap) {
+	const own = Object.getOwnPropertyDescriptor(target, key);
+	let prototype = target;
+	let descriptor;
+	while (prototype !== null && descriptor === void 0) {
+		descriptor = Object.getOwnPropertyDescriptor(prototype, key);
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	if (typeof descriptor?.value !== "function") throw new Error(`multi-root: ${String(key)} is not a public method`);
+	const value = wrap(descriptor.value);
+	Object.defineProperty(target, key, {
+		configurable: true,
+		writable: true,
+		enumerable: own?.enumerable ?? false,
+		value
+	});
+	return () => {
+		if (Object.getOwnPropertyDescriptor(target, key)?.value !== value) return;
+		if (own === void 0) Reflect.deleteProperty(target, key);
+		else Object.defineProperty(target, key, own);
+	};
+}
+//#endregion
+export { wrapMethod as t };