@dsh-electron/dsh-plugin-multi-root-workspace 0.1.7 → 0.1.8

package/CHANGELOG.en.md

@@ -8,6 +8,12 @@ This file records the user-visible changes of every **released** version.
 - For installation sources, the supported upstream runtimes, and known limitations, see the [README](./README.en.md).
 - The evidence, numbering, and release state of each version live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账). The body of each GitHub Release is generated from the commit history by `scripts/release-notes.mjs` and is the complete raw list behind this file.
 
+## [0.1.8] - 2026-10-18
+
+### Fixed
+
+- **Permission settings page unavailable on DSH 0.2.0**: when installed via `link:`, the plugin resolved optional packages it never loads — packages consumed only as mounted host services (`dsh-lsp` / `dsh-lsp-stdio` / `dsh-working-directory`, among others) — to the checkout's own devDependencies, so a uniformly-versioned host was misjudged as `mixed`; and because the two replacement provider rows injected the compatibility gate while upstream `fs-sandbox` / `sandbox` were already disabled unconditionally, a refused gate removed `ctx.fs` / `ctx.sandbox`, taking down `ctx.shell` and `permissionPresets` with it (`permissionPresets/catalog` reported `service-unavailable`). Optional packages are now classified by who loads the resolved copy and through which anchor — runtime-loaded, host-service, or runner-anchored — so host-service copies inside the plugin root no longer testify, and the Windows ACL package is inspected from the `dsh-sandbox-local` anchor; the two provider rows no longer inject the gate and degrade to upstream-equivalent behavior on a refused installation, while every widened-authority row stays gated (see [ADR-0009 amendment](./docs/decisions/ADR-0009-dsh-compat-contract.md#修订2026-10-18permissionpresetscatalog-事故误报检测--被门禁的-provider)).
+
 ## [0.1.7] - 2026-10-17
 
 ### Added
@@ -156,7 +162,8 @@ The first release: the three MVP milestones (M1–M3).
 
 - All eight findings of the pre-release external review (three of them release-blocking) are fixed, each with a regression test: a registered directory replaced by a symlink transplanting its authority (which introduced `recordedPath` — **re-resolving a path is not re-authorizing it**), concurrent registry mutations losing a write or reviving a revoked grant (per-primary-root mutations are serialized), a refresh not re-checking directories, a typed path being overwritten by the directory picker, the `reveal` response contract and failure code, duplicate ids not validated, the primary root missing from nesting validation, and CI testing before building.
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.7...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.8...HEAD
+[0.1.8]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.7...v0.1.8
 [0.1.7]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.4...v0.1.5

package/CHANGELOG.md

@@ -8,6 +8,12 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 - 安装方式、受支持的上游运行时与已知限制见 [README](./README.md)。
 - 每个版本的实施证据、编号口径与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)；GitHub Release 的正文由 `scripts/release-notes.mjs` 从 commit 历史生成，是本文件之外的完整原始清单。
 
+## [0.1.8] - 2026-10-18
+
+### Fixed
+
+- **DSH 0.2.0 上权限设置页不可用**：以 `link:` 方式安装时，插件把只作为宿主服务消费、自身从不加载的可选包（`dsh-lsp` / `dsh-lsp-stdio` / `dsh-working-directory` 等）解析到检出目录自己的 devDependencies，版本统一的宿主被误判为 `mixed`；同时两个 provider 替身行 inject 兼容门禁而上游 `fs-sandbox` / `sandbox` 已被无条件禁用，门禁一旦拒绝，`ctx.fs` / `ctx.sandbox` 消失并连带 `ctx.shell` 与 `permissionPresets` 瘫痪（`permissionPresets/catalog` 报 `service-unavailable`）。可选包现按"谁加载副本、经哪个锚点"分为运行时加载、宿主服务与 runner 锚定三类——插件根内的宿主服务副本不再作证，Windows ACL 包改从 `dsh-sandbox-local` 锚点取证；两个 provider 行不再 inject 门禁，在被拒安装上退化为上游等价行为，宽授权行的门禁不变（[ADR-0009 修订](./docs/decisions/ADR-0009-dsh-compat-contract.md#修订2026-10-18permissionpresetscatalog-事故误报检测--被门禁的-provider)）。
+
 ## [0.1.7] - 2026-10-17
 
 ### Added
@@ -156,7 +162,8 @@ English: [CHANGELOG.en.md](./CHANGELOG.en.md)
 
 - 发布前外部评审提出的 8 项发现（其中 3 项发布阻断）全部修复，每项各带一个回归测试：登记目录被替换为符号链接后授权转移（引入 `recordedPath`，**重新解析路径不等于重新授权**）、并发修改注册表丢写或复活已撤销的授权（每个主根的变更串行）、刷新不重新检查目录、手输路径被目录选择器覆盖、`reveal` 的应答契约与失败码、重复 id 未校验、主根未纳入嵌套校验、CI 先测后构建。
 
-[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.7...HEAD
+[Unreleased]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.8...HEAD
+[0.1.8]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.7...v0.1.8
 [0.1.7]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/cherrchen/dsh-plugin-multi-root-workspace/compare/v0.1.4...v0.1.5

package/README.en.md

@@ -16,7 +16,7 @@ A real development project is usually several independent Git repositories, and
 - **Security does not degrade**: additional roots are authorized through the same mechanism the harness already uses — an in-process filesystem fence plus kernel-level sandboxes (macOS Seatbelt / Linux bwrap / Landlock / Windows ACL), with files and bash sharing one and the same scope. It never degenerates into full access or prompt-level constraints.
 - **Absent when absent**: with no additional root configured, its behavior is item-for-item identical to an uninstalled harness; every misconfiguration fails loudly instead of silently degrading.
 
-Current released version: `v0.1.7`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
+Current released version: `v0.1.8`. The user-visible changes of each version live in the [CHANGELOG](./CHANGELOG.en.md); progress and release state live in the [roadmap progress ledger](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账).
 
 ## Quick Start
 
@@ -87,8 +87,8 @@ This installs pre-built artifacts; the first install needs the `allowBuilds` add
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # or download the tgz from the GitHub Release assets, e.g.:
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.7/dsh-electron-dsh-plugin-multi-root-workspace-0.1.7.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.7.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.8/dsh-electron-dsh-plugin-multi-root-workspace-0.1.8.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.8.tgz
 ```
 
 Also pre-built, handy for air-gapped or offline delivery; the first install needs the same `allowBuilds` addition.
@@ -107,10 +107,10 @@ allowBuilds:
   koffi: true
 ```
 
-Pinning a version (e.g. `#v0.1.7`) is recommended so a later push cannot silently change what actually runs:
+Pinning a version (e.g. `#v0.1.8`) is recommended so a later push cannot silently change what actually runs:
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.7
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.8
 ```
 
 ### Install from a local clone

package/README.md

@@ -16,7 +16,7 @@ DSH（DeepSeek Harness）原生只把会话启动的目录当作 Agent 唯一的
 - **安全不降级**：附加根走上游同款授权机制——进程内文件围栏 + 内核级沙箱（macOS Seatbelt / Linux bwrap / Landlock / Windows ACL），文件与 bash 共享同一份授权范围，绝不退化成全开放或只靠提示词约束。
 - **不配等于没装**：未登记附加根时行为与未装插件逐项一致；配置错误一律明确报错，从不静默降级。
 
-当前发布版本 `v0.1.7`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
+当前发布版本 `v0.1.8`。各版本的用户可见变更见 [CHANGELOG](./CHANGELOG.md)；进度与发布状态见[路线图 §进度总账](./docs/plans/active/2026-09-12-multi-root-workspace.md#进度总账)。
 
 ## 快速开始
 
@@ -89,8 +89,8 @@ dsh plugin --profile web add @dsh-electron/dsh-plugin-multi-root-workspace
 ```sh
 pnpm pack @dsh-electron/dsh-plugin-multi-root-workspace
 # 或从 GitHub Release 资产下载，例如：
-# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.7/dsh-electron-dsh-plugin-multi-root-workspace-0.1.7.tgz
-dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.7.tgz
+# https://github.com/cherrchen/dsh-plugin-multi-root-workspace/releases/download/v0.1.8/dsh-electron-dsh-plugin-multi-root-workspace-0.1.8.tgz
+dsh plugin --profile web add ./dsh-electron-dsh-plugin-multi-root-workspace-0.1.8.tgz
 ```
 
 同样是预构建产物，适合内网或离线环境交付；首次安装同样需要添加 `allowBuilds`。
@@ -109,10 +109,10 @@ allowBuilds:
   koffi: true
 ```
 
-建议锁定版本（如 `#v0.1.7`），让后续推送无法悄悄改变实际运行的内容：
+建议锁定版本（如 `#v0.1.8`），让后续推送无法悄悄改变实际运行的内容：
 
 ```sh
-dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.7
+dsh plugin --profile web add github:cherrchen/dsh-plugin-multi-root-workspace#v0.1.8
 ```
 
 ### 从本地源码安装

package/cordis.patch.yml

@@ -32,12 +32,20 @@
 - id: sandbox
   disabled: true
 - insert:
-    # The compatibility gate comes first, and every security-relevant row below
-    # injects `multiRootCompat`. If the installed DSH release is not on this
-    # plugin's allowlist, this row throws and none of them start, rather than
-    # widening a sandbox profile whose shape was never verified (ADR-0009).
+    # The compatibility gate comes first, and every widened-authority row
+    # below injects `multiRootCompat`. If the installed DSH release is not on
+    # this plugin's allowlist, this row throws and none of them start, rather
+    # than widening a sandbox profile whose shape was never verified (ADR-0009).
     - id: multi-root-compat
       name: '@dsh-electron/dsh-plugin-multi-root-workspace/compat'
+    # The two PROVIDER rows deliberately do NOT inject the gate: their widening
+    # is scope-driven, and the gated registry can never populate the scope on a
+    # refused installation, so they degenerate to the upstream providers. They
+    # MUST keep serving: upstream `fs-sandbox`/`sandbox` are already disabled
+    # above, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+    # `permissionPresets` and every confining tool down with them — a refused
+    # gate would brick the profile instead of degrading to "plugin not
+    # installed" (ADR-0009).
     - id: multi-root-fs
       name: '@dsh-electron/dsh-plugin-multi-root-workspace/fs'
     - id: multi-root-sandbox

package/lib/{compat-DF_yL1bB.js → compat-DR2LvmYZ.js}

@@ -1,7 +1,8 @@
 import { createRequire } from "node:module";
 import { Service } from "@deepseek-ai/cordis";
-import { readFileSync, readdirSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 //#region src/compat/dsh-version.ts
 /**
 * The DSH compatibility contract: which upstream releases this plugin is
@@ -86,39 +87,175 @@ const OPTIONAL_CORE_PACKAGES = [
 	"@deepseek-ai/dsh-subprocess",
 	"@deepseek-ai/dsh-system-prompt"
 ];
+/**
+* The optional packages this plugin loads itself at run time, through dynamic
+* `import()`s inside this package's own modules. The copy this module resolves
+* IS the copy that would execute, so every resolvable hit testifies — a
+* private copy inside this package's own tree genuinely loads, and a version
+* that disagrees with the host is a real mixed installation, not a phantom.
+*/
+const RUNTIME_OPTIONAL_PACKAGES = [
+	"@deepseek-ai/dsh-agent-instructions",
+	"@deepseek-ai/dsh-llm",
+	"@deepseek-ai/dsh-session",
+	"@deepseek-ai/dsh-typert-protocol"
+];
+/**
+* The optional packages this plugin consumes only as mounted host services or
+* ambient types — it never imports them, so a copy inside this package's own
+* tree can never execute. The only version that testifies is the one the
+* COMPOSITION resolves (the installation or the profile): a resolution that
+* lands inside this package's own root is a private development or bundled
+* copy and must be reported absent — otherwise a `link:`-installed checkout
+* whose devDependencies carry a newer release phantom-mixes every supported
+* host it is developed against (the report that motivated this split:
+* `dsh-lsp`/`dsh-lsp-stdio`/`dsh-working-directory` resolving to the plugin's
+* devDependencies on a `0.2.0-rc.2` host produced a `mixed` verdict on a
+* uniformly `0.2.0-rc.2` installation).
+*/
+const HOST_SERVICE_PACKAGES = [
+	"@deepseek-ai/dsh-agent",
+	"@deepseek-ai/dsh-api-workspace-files",
+	"@deepseek-ai/dsh-client-connection",
+	"@deepseek-ai/dsh-commands",
+	"@deepseek-ai/dsh-lsp",
+	"@deepseek-ai/dsh-lsp-stdio",
+	"@deepseek-ai/dsh-subprocess",
+	"@deepseek-ai/dsh-system-prompt",
+	"@deepseek-ai/dsh-tools",
+	"@deepseek-ai/dsh-working-directory"
+];
+/**
+* Optional packages this plugin executes that are resolved through an anchor
+* OTHER than this module. The standalone Windows ACL runner
+* (`src/windows-runner.ts`) imports `@deepseek-ai/dsh-sandbox-windows-acl` by
+* self-reference from the upstream runner's own install location — a file the
+* installed `dsh-sandbox-local` points at in its confined argv — so the copy
+* that testifies is the one sibling to that required package, not whatever
+* this module can reach. Neither the self-resolution hit nor the
+* `@deepseek-ai/dsh` host anchor reflects execution here: if sandbox-local's
+* own anchor cannot see the package, the runner cannot load it either, and
+* absent is the honest answer.
+*/
+const RUNNER_ANCHORED_PACKAGES = ["@deepseek-ai/dsh-sandbox-windows-acl"];
+/** The required package whose tree produces the upstream runner argv. */
+const RUNNER_ANCHOR_PACKAGE = "@deepseek-ai/dsh-sandbox-local";
 /** Every package the contract inspects, required first. */
 const CORE_PACKAGES = [...REQUIRED_CORE_PACKAGES, ...OPTIONAL_CORE_PACKAGES];
-/** Services looked up structurally; older runtimes never install these modules. */
-const HOST_RESOLVED_PACKAGES = ["@deepseek-ai/dsh-working-directory"];
 /** The environment variable that relaxes the gate. */
 const COMPAT_ENFORCEMENT_ENV = "DSH_MULTI_ROOT_COMPAT";
 /**
+* Resolve one package's `package.json` path through a require, or `undefined`
+* when it cannot be resolved. The path — not just the version — matters: the
+* caller needs to know WHERE the copy lives to judge whether it belongs to the
+* inspected installation.
+* @param require - the require to resolve through.
+* @param packageName - the package to locate.
+* @returns the manifest path, or `undefined`.
+*/
+function resolvePackageJson(require, packageName) {
+	try {
+		return require.resolve(`${packageName}/package.json`);
+	} catch {
+		return;
+	}
+}
+/** Read `version` off a resolved manifest path; a broken manifest is absent. */
+function versionOfManifest(manifestPath) {
+	try {
+		const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+		return typeof manifest.version === "string" ? manifest.version : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The second resolution anchor: a require rooted at the installed
+* `@deepseek-ai/dsh` meta package. Host-internal packages that never appear as
+* plugin peers are only reachable this way (the pattern the retired
+* `HOST_RESOLVED_PACKAGES` list carved out for `dsh-working-directory`,
+* generalized here to every host-service package).
+* @param require - this module's require, used to locate the meta package.
+* @returns the host-rooted require, or `undefined` when `dsh` itself cannot be
+*   resolved.
+*/
+function hostAnchorRequire(require) {
+	const anchor = resolvePackageJson(require, "@deepseek-ai/dsh");
+	return anchor === void 0 ? void 0 : createRequire(anchor);
+}
+/**
+* This package's own install root — the boundary between a copy that belongs
+* to the inspected installation and a private copy only this package can see.
+* @param require - this module's require; self-reference through the package's
+*   `exports` is tried first, then a walk up from this module's file.
+* @returns the package root, or `undefined` when neither anchor works.
+*/
+function pluginPackageRoot(require) {
+	try {
+		return dirname(require.resolve("@dsh-electron/dsh-plugin-multi-root-workspace/package.json"));
+	} catch {
+		let dir = dirname(fileURLToPath(import.meta.url));
+		while (true) {
+			if (existsSync(join(dir, "package.json"))) return dir;
+			const parent = dirname(dir);
+			if (parent === dir) return void 0;
+			dir = parent;
+		}
+	}
+}
+/**
+* Whether a resolved manifest path lives inside this package's own root — the
+* mark of a private copy no composition can mount. An unknown root cannot
+* exclude anything, so it answers `false` rather than guessing.
+*/
+function insidePackageRoot(manifestPath, root) {
+	return root !== void 0 && (manifestPath === root || manifestPath.startsWith(`${root}${sep}`));
+}
+/**
 * Read one package's declared version through Node resolution.
 *
-* Resolution runs from THIS module, which is what makes the answer meaningful:
-* the upstream packages are peer dependencies, so they resolve to the single
-* copy the host provides — the same copy the providers will subclass at
-* runtime. A package that cannot be resolved is reported absent rather than
-* throwing, because "not installed" is a legitimate answer for every optional
-* package.
+* Resolution runs from THIS module — for required and runtime-loaded packages
+* the copy found here is the copy that would execute, which is what makes the
+* answer meaningful: the upstream packages are peer dependencies, so they
+* resolve to the single copy the host provides — the same copy the providers
+* will subclass at runtime.
+*
+* {@link HOST_SERVICE_PACKAGES} are different: the plugin never imports them,
+* so a copy inside this package's own tree can never execute, and counting it
+* would report a mixed installation out of a linked checkout's devDependencies
+* alone. Only a hit OUTSIDE this package's root — a copy the composition could
+* mount — testifies; when this module cannot reach the package at all, the
+* `@deepseek-ai/dsh` host manifest supplies a second anchor for host-internal
+* packages that are never plugin peers.
+*
+* {@link RUNNER_ANCHORED_PACKAGES} are a third policy: executed, but resolved
+* from the upstream-runner anchor rather than this module, so only a hit
+* sibling to the installed `dsh-sandbox-local` testifies.
+*
+* A package that cannot be resolved in either place is reported absent rather
+* than throwing, because "not installed" is a legitimate answer for every
+* optional package.
 * @param packageName - the package to inspect.
 * @returns the declared version, or `undefined` when the package or its
 *   manifest cannot be resolved.
 */
 function readInstalledVersion(packageName) {
 	const require = createRequire(import.meta.url);
-	try {
-		const manifest = require(`${packageName}/package.json`);
-		return typeof manifest.version === "string" ? manifest.version : void 0;
-	} catch {
-		if (!HOST_RESOLVED_PACKAGES.includes(packageName)) return void 0;
-		try {
-			const manifest = createRequire(require.resolve("@deepseek-ai/dsh/package.json"))(`${packageName}/package.json`);
-			return typeof manifest.version === "string" ? manifest.version : void 0;
-		} catch {
-			return;
-		}
+	if (RUNNER_ANCHORED_PACKAGES.includes(packageName)) {
+		const anchor = resolvePackageJson(require, RUNNER_ANCHOR_PACKAGE);
+		const hit = anchor === void 0 ? void 0 : resolvePackageJson(createRequire(anchor), packageName);
+		return hit === void 0 ? void 0 : versionOfManifest(hit);
+	}
+	if (!HOST_SERVICE_PACKAGES.includes(packageName)) {
+		const hit = resolvePackageJson(require, packageName);
+		return hit === void 0 ? void 0 : versionOfManifest(hit);
 	}
+	const root = pluginPackageRoot(require);
+	const selfHit = resolvePackageJson(require, packageName);
+	if (selfHit !== void 0 && !insidePackageRoot(selfHit, root)) return versionOfManifest(selfHit);
+	const host = hostAnchorRequire(require);
+	const hostHit = host === void 0 ? void 0 : resolvePackageJson(host, packageName);
+	return hostHit === void 0 || insidePackageRoot(hostHit, root) ? void 0 : versionOfManifest(hostHit);
 }
 /**
 * Judge one installation against the contract.
@@ -223,7 +360,7 @@ function report(verdict, release, packages, lines) {
 * Resolution follows the optional-peer precedent (`agent-instructions.ts`):
 * the backend is not a peer of this plugin, so the plugin anchor is tried
 * first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
-* same `HOST_RESOLVED_PACKAGES` pattern as `dsh-version.ts` — because the
+* same host-anchor fallback pattern as `dsh-version.ts` — because the
 * backend rides inside the harness meta package's own dependency tree.
 *
 * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker
@@ -256,7 +393,7 @@ var PtyMarkerContractError = class extends Error {
 * reach: this module first (flat layouts where the backend is a direct
 * install), then the `@deepseek-ai/dsh` host manifest (pnpm-style layouts
 * where it is the meta package's own dependency — the
-* `HOST_RESOLVED_PACKAGES` precedent). A resolution failure that is not a
+* host-anchor fallback pattern in `dsh-version.ts`). A resolution failure that is not a
 * genuine NOT_FOUND propagates: a resolvable-but-broken specifier is not
 * evidence of absence.
 */
@@ -354,16 +491,26 @@ function assertAgentPtyMarker(io = defaultIo) {
 * `multi-root-compat`: the startup gate that turns the DSH compatibility
 * contract from documentation into a precondition.
 *
-* The four security-relevant rows of this bundle — `multi-root-fs`,
-* `multi-root-sandbox`, `multi-root-registry`, `multi-root-instructions` —
-* inject `multiRootCompat`. Cordis will not start a plugin whose injected
-* service is absent, so this row is what decides whether they run at all:
+* Every widened-authority row of this bundle — `multi-root-providers`,
+* `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
+* `multi-root-workspace-files`, `multi-root-process-fence` — injects
+* `multiRootCompat`. Cordis will not start a plugin whose injected service is
+* absent, so this row is what decides whether they run at all:
 *
 * ```text
-* compat check passes  →  ctx.multiRootCompat exists  →  the providers start
+* compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
 * compat check fails   →  the row throws             →  they never start
 * ```
 *
+* The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
+* do NOT inject the gate: their widening is scope-driven, and the gated
+* registry can never populate the scope on a refused installation — so they
+* degenerate to the upstream providers. That is what keeps a refused gate a
+* loud degradation (the plugin's features absent, the profile intact) instead
+* of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
+* the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+* `permissionPresets` and every confining tool down with them.
+*
 * That is why the gate is a plain `apply` and not a `Service` subclass mounted
 * directly: the check has to be able to fail BEFORE the service exists. A
 * `Service` constructor has already run `super(ctx, name)` — and therefore
@@ -450,4 +597,4 @@ function apply(ctx) {
 	ctx.plugin(MultiRootCompatService, report);
 }
 //#endregion
-export { inject as a, agentPtyMarkerVerdict as c, OPTIONAL_CORE_PACKAGES as d, REQUIRED_CORE_PACKAGES as f, readInstalledVersion as g, compatEnforcement as h, assertSupportedInstallation as i, assertAgentPtyMarker as l, classifyInstallation as m, MultiRootCompatService as n, AGENT_PTY_MARKER as o, SUPPORTED_DSH_RELEASES as p, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t, CORE_PACKAGES as u };
+export { classifyInstallation as _, inject as a, agentPtyMarkerVerdict as c, HOST_SERVICE_PACKAGES as d, OPTIONAL_CORE_PACKAGES as f, SUPPORTED_DSH_RELEASES as g, RUNTIME_OPTIONAL_PACKAGES as h, assertSupportedInstallation as i, assertAgentPtyMarker as l, RUNNER_ANCHORED_PACKAGES as m, MultiRootCompatService as n, AGENT_PTY_MARKER as o, REQUIRED_CORE_PACKAGES as p, apply as r, PtyMarkerContractError as s, DshCompatUnsupportedError as t, CORE_PACKAGES as u, compatEnforcement as v, readInstalledVersion as y };

package/lib/compat.js

@@ -1,2 +1,2 @@
-import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-DF_yL1bB.js";
+import { a as inject, i as assertSupportedInstallation, n as MultiRootCompatService, r as apply, t as DshCompatUnsupportedError } from "./compat-DR2LvmYZ.js";
 export { DshCompatUnsupportedError, MultiRootCompatService, apply, assertSupportedInstallation, inject };

package/lib/{fs-9JIzGaf3.js → fs-Nlp2AiRX.js}

@@ -65,11 +65,7 @@ async function isPathUnder(path, root, caseSensitive = process.platform !== "win
 * roots.
 */
 var MultiRootFileSystem = class extends LocalFileSystem {
-	static inject = [
-		"multiRootCompat",
-		"sandboxPolicy",
-		"multiRootScope"
-	];
+	static inject = ["sandboxPolicy", "multiRootScope"];
 	defaultMode;
 	constructor(ctx, config) {
 		super(ctx, config);

package/lib/fs.js

@@ -1,3 +1,3 @@
 import "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-9JIzGaf3.js";
+import { t as MultiRootFileSystem } from "./fs-Nlp2AiRX.js";
 export { MultiRootFileSystem, MultiRootFileSystem as default };

package/lib/index.js

@@ -1,9 +1,9 @@
-import { c as agentPtyMarkerVerdict, d as OPTIONAL_CORE_PACKAGES, f as REQUIRED_CORE_PACKAGES, g as readInstalledVersion, h as compatEnforcement, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as classifyInstallation, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as SUPPORTED_DSH_RELEASES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES } from "./compat-DF_yL1bB.js";
+import { _ as classifyInstallation, c as agentPtyMarkerVerdict, d as HOST_SERVICE_PACKAGES, f as OPTIONAL_CORE_PACKAGES, g as SUPPORTED_DSH_RELEASES, h as RUNTIME_OPTIONAL_PACKAGES, i as assertSupportedInstallation, l as assertAgentPtyMarker, m as RUNNER_ANCHORED_PACKAGES, n as MultiRootCompatService, o as AGENT_PTY_MARKER, p as REQUIRED_CORE_PACKAGES, s as PtyMarkerContractError, t as DshCompatUnsupportedError, u as CORE_PACKAGES, v as compatEnforcement, y as readInstalledVersion } from "./compat-DR2LvmYZ.js";
 import { a as composeInstructionMessage, c as createInstructionMessage, l as instructionsApi, r as PLUGIN_SOURCE, t as DEFAULT_MAX_BYTES, u as renderInstructions } from "./instructions-D19jRxN0.js";
-import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-Kup4_ZIb.js";
+import { n as widenConfined, t as MultiRootSandboxProvider } from "./sandbox-CVAcT_gy.js";
 import { a as classifyStoredRoots, c as indexedStatuses, i as canonicalRoot, l as isCanonicallyUnder, m as validateRootCandidate, n as additionalRootId, p as resolveRootRef, r as availableRoots, s as expandRootInput, t as RootValidationError, u as removeStatusAt } from "./roots-B-0l8mNG.js";
 import { MULTI_ROOT_PROVIDER_BRAND, MultiRootProviders, brandMultiRootProvider, isMultiRootProvider } from "./providers.js";
-import { t as MultiRootFileSystem } from "./fs-9JIzGaf3.js";
+import { t as MultiRootFileSystem } from "./fs-Nlp2AiRX.js";
 import { a as parseRevealedView, i as parsePanelCall, n as PANEL_ENDPOINTS, o as parseRootsView, t as PANEL_CHANNEL } from "./contract-DZ4zczDT.js";
 import { MultiRootScopeService, renderWorkspaceRootsContext, sanitizeAdditionalRoots } from "./scope.js";
 import { a as MultiRootRegistry, c as multiRootDomainSpec, i as MAX_ALIAS_LENGTH, l as RegistryAuthorityLease, n as DOMAIN_NAME, o as REGISTRY_CONTENDED_MESSAGE, r as MAX_ADDITIONAL_ROOTS_CEILING, t as DEFAULT_MAX_ADDITIONAL_ROOTS, u as RegistryLeaseContendedError } from "./registry-DCxC5Lay.js";
@@ -18,4 +18,4 @@ import { a as renderRootsReport, c as revealArgv, i as parseFoldersCommand, o as
 const inject = [];
 function apply() {}
 //#endregion
-export { AGENT_PTY_MARKER, COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_ADDITIONAL_ROOTS, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MULTI_ROOT_PROVIDER_BRAND, MultiRootCompatService, MultiRootFileSystem, MultiRootProviders, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, PtyMarkerContractError, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, agentPtyMarkerVerdict, apply, assertAgentPtyMarker, assertSupportedInstallation, availableRoots, brandMultiRootProvider, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, isMultiRootProvider, multiRootDomainSpec, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };
+export { AGENT_PTY_MARKER, COMMAND_NAME, CORE_PACKAGES, DEFAULT_MAX_ADDITIONAL_ROOTS, DEFAULT_MAX_BYTES, DOMAIN_NAME, DshCompatUnsupportedError, HOST_SERVICE_PACKAGES, MAX_ADDITIONAL_ROOTS_CEILING, MAX_ALIAS_LENGTH, MULTI_ROOT_PROVIDER_BRAND, MultiRootCompatService, MultiRootFileSystem, MultiRootProviders, MultiRootRegistry, MultiRootSandboxProvider, MultiRootScopeService, OPTIONAL_CORE_PACKAGES, PANEL_CHANNEL, PANEL_ENDPOINTS, PLUGIN_SOURCE, PtyMarkerContractError, REGISTRY_CONTENDED_MESSAGE, REQUIRED_CORE_PACKAGES, RUNNER_ANCHORED_PACKAGES, RUNTIME_OPTIONAL_PACKAGES, RegistryAuthorityLease, RegistryLeaseContendedError, RootValidationError, SUPPORTED_DSH_RELEASES, additionalRootId, agentPtyMarkerVerdict, apply, assertAgentPtyMarker, assertSupportedInstallation, availableRoots, brandMultiRootProvider, canonicalRoot, classifyInstallation, classifyStoredRoots, compatEnforcement, composeInstructionMessage, createInstructionMessage, expandRootInput, indexedStatuses, inject, instructionsApi, isCanonicallyUnder, isMultiRootProvider, multiRootDomainSpec, parseFoldersCommand, parsePanelCall, parseRevealedView, parseRootsView, readInstalledVersion, removeStatusAt, renderInstructions, renderRootsReport, renderWorkspaceRootsContext, resolvePanelPrimaryRoot, resolveRootRef, revealArgv, sanitizeAdditionalRoots, validateRootCandidate, widenConfined };

package/lib/{sandbox-Kup4_ZIb.js → sandbox-CVAcT_gy.js}

@@ -2,9 +2,9 @@ import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as asser
 import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
 import { brandMultiRootProvider } from "./providers.js";
 import { posix } from "node:path";
+import { fileURLToPath } from "node:url";
 import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
 import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
-import { fileURLToPath } from "node:url";
 //#region src/compat/sandbox-confine.ts
 /** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
 function isThenable(value) {
@@ -557,11 +557,7 @@ function windowsContained(candidate, root) {
 * grant mechanics stay the upstream implementation's.
 */
 var MultiRootSandboxProvider = class extends LocalSandboxProvider {
-	static inject = [
-		"multiRootCompat",
-		"sandboxPolicy",
-		"multiRootScope"
-	];
+	static inject = ["sandboxPolicy", "multiRootScope"];
 	constructor(ctx, config) {
 		super(ctx, config);
 		brandMultiRootProvider(this, "sandbox");

package/lib/sandbox.js

@@ -1,3 +1,3 @@
-import { t as MultiRootSandboxProvider } from "./sandbox-Kup4_ZIb.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-CVAcT_gy.js";
 import "./providers.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/types/compat/dsh-version.d.ts

@@ -43,10 +43,43 @@ export declare const REQUIRED_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@
  * that is the mixed-installation failure this contract exists to catch.
  */
 export declare const OPTIONAL_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
+/**
+ * The optional packages this plugin loads itself at run time, through dynamic
+ * `import()`s inside this package's own modules. The copy this module resolves
+ * IS the copy that would execute, so every resolvable hit testifies — a
+ * private copy inside this package's own tree genuinely loads, and a version
+ * that disagrees with the host is a real mixed installation, not a phantom.
+ */
+export declare const RUNTIME_OPTIONAL_PACKAGES: readonly ["@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-typert-protocol"];
+/**
+ * The optional packages this plugin consumes only as mounted host services or
+ * ambient types — it never imports them, so a copy inside this package's own
+ * tree can never execute. The only version that testifies is the one the
+ * COMPOSITION resolves (the installation or the profile): a resolution that
+ * lands inside this package's own root is a private development or bundled
+ * copy and must be reported absent — otherwise a `link:`-installed checkout
+ * whose devDependencies carry a newer release phantom-mixes every supported
+ * host it is developed against (the report that motivated this split:
+ * `dsh-lsp`/`dsh-lsp-stdio`/`dsh-working-directory` resolving to the plugin's
+ * devDependencies on a `0.2.0-rc.2` host produced a `mixed` verdict on a
+ * uniformly `0.2.0-rc.2` installation).
+ */
+export declare const HOST_SERVICE_PACKAGES: readonly ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory"];
+/**
+ * Optional packages this plugin executes that are resolved through an anchor
+ * OTHER than this module. The standalone Windows ACL runner
+ * (`src/windows-runner.ts`) imports `@deepseek-ai/dsh-sandbox-windows-acl` by
+ * self-reference from the upstream runner's own install location — a file the
+ * installed `dsh-sandbox-local` points at in its confined argv — so the copy
+ * that testifies is the one sibling to that required package, not whatever
+ * this module can reach. Neither the self-resolution hit nor the
+ * `@deepseek-ai/dsh` host anchor reflects execution here: if sandbox-local's
+ * own anchor cannot see the package, the runner cannot load it either, and
+ * absent is the honest answer.
+ */
+export declare const RUNNER_ANCHORED_PACKAGES: readonly ["@deepseek-ai/dsh-sandbox-windows-acl"];
 /** Every package the contract inspects, required first. */
 export declare const CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-fs-local", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-local", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
-/** Services looked up structurally; older runtimes never install these modules. */
-export declare const HOST_RESOLVED_PACKAGES: readonly ["@deepseek-ai/dsh-working-directory"];
 /** How this plugin reacts to an installation it does not support. */
 export type CompatEnforcement = 'enforce' | 'warn';
 /** The environment variable that relaxes the gate. */
@@ -85,12 +118,27 @@ export type VersionReader = (packageName: string) => string | undefined;
 /**
  * Read one package's declared version through Node resolution.
  *
- * Resolution runs from THIS module, which is what makes the answer meaningful:
- * the upstream packages are peer dependencies, so they resolve to the single
- * copy the host provides — the same copy the providers will subclass at
- * runtime. A package that cannot be resolved is reported absent rather than
- * throwing, because "not installed" is a legitimate answer for every optional
- * package.
+ * Resolution runs from THIS module — for required and runtime-loaded packages
+ * the copy found here is the copy that would execute, which is what makes the
+ * answer meaningful: the upstream packages are peer dependencies, so they
+ * resolve to the single copy the host provides — the same copy the providers
+ * will subclass at runtime.
+ *
+ * {@link HOST_SERVICE_PACKAGES} are different: the plugin never imports them,
+ * so a copy inside this package's own tree can never execute, and counting it
+ * would report a mixed installation out of a linked checkout's devDependencies
+ * alone. Only a hit OUTSIDE this package's root — a copy the composition could
+ * mount — testifies; when this module cannot reach the package at all, the
+ * `@deepseek-ai/dsh` host manifest supplies a second anchor for host-internal
+ * packages that are never plugin peers.
+ *
+ * {@link RUNNER_ANCHORED_PACKAGES} are a third policy: executed, but resolved
+ * from the upstream-runner anchor rather than this module, so only a hit
+ * sibling to the installed `dsh-sandbox-local` testifies.
+ *
+ * A package that cannot be resolved in either place is reported absent rather
+ * than throwing, because "not installed" is a legitimate answer for every
+ * optional package.
  * @param packageName - the package to inspect.
  * @returns the declared version, or `undefined` when the package or its
  *   manifest cannot be resolved.

package/lib/types/compat/pty-marker.d.ts

@@ -21,7 +21,7 @@
  * Resolution follows the optional-peer precedent (`agent-instructions.ts`):
  * the backend is not a peer of this plugin, so the plugin anchor is tried
  * first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
- * same `HOST_RESOLVED_PACKAGES` pattern as `dsh-version.ts` — because the
+ * same host-anchor fallback pattern as `dsh-version.ts` — because the
  * backend rides inside the harness meta package's own dependency tree.
  *
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker

package/lib/types/compat.d.ts

@@ -2,16 +2,26 @@
  * `multi-root-compat`: the startup gate that turns the DSH compatibility
  * contract from documentation into a precondition.
  *
- * The four security-relevant rows of this bundle — `multi-root-fs`,
- * `multi-root-sandbox`, `multi-root-registry`, `multi-root-instructions` —
- * inject `multiRootCompat`. Cordis will not start a plugin whose injected
- * service is absent, so this row is what decides whether they run at all:
+ * Every widened-authority row of this bundle — `multi-root-providers`,
+ * `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
+ * `multi-root-workspace-files`, `multi-root-process-fence` — injects
+ * `multiRootCompat`. Cordis will not start a plugin whose injected service is
+ * absent, so this row is what decides whether they run at all:
  *
  * ```text
- * compat check passes  →  ctx.multiRootCompat exists  →  the providers start
+ * compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
  * compat check fails   →  the row throws             →  they never start
  * ```
  *
+ * The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
+ * do NOT inject the gate: their widening is scope-driven, and the gated
+ * registry can never populate the scope on a refused installation — so they
+ * degenerate to the upstream providers. That is what keeps a refused gate a
+ * loud degradation (the plugin's features absent, the profile intact) instead
+ * of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
+ * the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+ * `permissionPresets` and every confining tool down with them.
+ *
  * That is why the gate is a plain `apply` and not a `Service` subclass mounted
  * directly: the check has to be able to fail BEFORE the service exists. A
  * `Service` constructor has already run `super(ctx, name)` — and therefore

package/lib/types/index.d.ts

@@ -21,7 +21,7 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace
  */
 export { DshCompatUnsupportedError, MultiRootCompatService, assertSupportedInstallation } from './compat.ts';
-export { classifyInstallation, compatEnforcement, CORE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
+export { classifyInstallation, compatEnforcement, CORE_PACKAGES, HOST_SERVICE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, RUNNER_ANCHORED_PACKAGES, RUNTIME_OPTIONAL_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
 export type { CompatEnforcement, CompatReport, CompatVerdict, InspectedPackage, SupportedDshRelease, VersionReader, } from './compat/dsh-version.ts';
 export { instructionsApi, renderInstructions } from './compat/agent-instructions.ts';
 export type { InstructionsApi, RenderedInstructions } from './compat/agent-instructions.ts';

package/lib/windows-runner.js

@@ -2,8 +2,8 @@ import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as asser
 import { createRequire } from "node:module";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, win32 } from "node:path";
-import { createHash } from "node:crypto";
 import { pathToFileURL } from "node:url";
+import { createHash } from "node:crypto";
 import { createConnection } from "node:net";
 //#region src/compat/windows-native.ts
 /** Public Win32 process primitives, resolved from the upstream ACL installation.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",