@dsh-electron/dsh-plugin-multi-root-workspace 0.1.7 → 0.1.9

package/lib/{sandbox-Kup4_ZIb.js → sandbox-CXk5h-ct.js}

@@ -1,10 +1,10 @@
-import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-CEfmZzu0.js";
-import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, t as DialectUnrecognizedError } from "./windows-runner-contract-B5R2K3mM.js";
+import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
 import { brandMultiRootProvider } from "./providers.js";
 import { posix } from "node:path";
 import { SandboxUnavailableError, canonicalPath } from "@deepseek-ai/dsh-sandbox";
-import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
 import { fileURLToPath } from "node:url";
+import { LocalSandboxProvider } from "@deepseek-ai/dsh-sandbox-local";
 //#region src/compat/sandbox-confine.ts
 /** Whether a value is a thenable, i.e. whether the installed `confine` is async. */
 function isThenable(value) {
@@ -557,11 +557,7 @@ function windowsContained(candidate, root) {
 * grant mechanics stay the upstream implementation's.
 */
 var MultiRootSandboxProvider = class extends LocalSandboxProvider {
-	static inject = [
-		"multiRootCompat",
-		"sandboxPolicy",
-		"multiRootScope"
-	];
+	static inject = ["sandboxPolicy", "multiRootScope"];
 	constructor(ctx, config) {
 		super(ctx, config);
 		brandMultiRootProvider(this, "sandbox");

package/lib/sandbox.js

@@ -1,3 +1,3 @@
-import { t as MultiRootSandboxProvider } from "./sandbox-Kup4_ZIb.js";
+import { t as MultiRootSandboxProvider } from "./sandbox-CXk5h-ct.js";
 import "./providers.js";
 export { MultiRootSandboxProvider, MultiRootSandboxProvider as default };

package/lib/scope.js

@@ -1,10 +1,10 @@
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
 import { r as effectiveRootAccess } from "./contract-DZ4zczDT.js";
-import { Service } from "@deepseek-ai/cordis";
 import { statSync } from "node:fs";
 import { isAbsolute } from "node:path";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { Service } from "@deepseek-ai/cordis";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/scope.ts
 /**
 * The multi-root workspace scope: the plugin's single home for the question
@@ -210,8 +210,7 @@ var MultiRootScopeService = class extends Service {
 		if (dshHome !== void 0 && (typeof dshHome !== "string" || dshHome.trim() === "" || !isAbsolute(dshHome))) ctx.logger.error(`multi-root-workspace: invalid dshHome config (expected an absolute path, got ${JSON.stringify(dshHome)}); the DSH-home deny boundary is disabled`);
 		else this.dshHome = dshHome;
 		aroundTool(ctx, (exec, next) => {
-			const parent = toolCapStore.getStore();
-			return toolCapStore.run({ capped: parent?.capped === true || this.caps[exec.name] === "read-only" }, next);
+			return toolCapStore.run({ capped: this.capForTool(exec.name) }, next);
 		});
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
 			scope.systemPrompt.context({
@@ -243,9 +242,19 @@ var MultiRootScopeService = class extends Service {
 	* @returns the canonical scope; `additionalRoots` is empty when none are registered.
 	*/
 	resolve(policy) {
+		return this.project(policy, this.capped());
+	}
+	/** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
+	previewForTool(policy, toolName) {
+		return this.project(policy, this.capForTool(toolName));
+	}
+	/** Execution and review use exactly the same parent-narrowing rule. */
+	capForTool(toolName) {
+		return this.capsInvalid || toolCapStore.getStore()?.capped === true || this.caps[toolName] === "read-only";
+	}
+	project(policy, capped) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
 		const roots = this.membersOf(primaryRoot);
-		const capped = this.capped();
 		const writable = capped || this.registryAuthority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
 		const denied = (this.rootsByPrimary.get(primaryRoot) ?? []).filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
 		const deniedRoots = [...new Set(denied)];

package/lib/types/auto-review/entry.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@deepseek-ai/cordis'
+/** Optional Auto Review Loader entry; supported only on DSH 0.2.1-rc.2. */
+export declare const name: string
+export declare const inject: string[]
+export declare function apply(ctx: Context): Promise<void>

package/lib/types/compat/auto-review-contract.d.ts

@@ -0,0 +1,3 @@
+/** The companion's joint support contract is deliberately narrower than the ordinary bundle. */
+export declare const AUTO_REVIEW_RELEASE = "0.2.1-rc.2";
+export declare function assertAutoReviewRelease(release: string | undefined): void;

package/lib/types/compat/auto-review-loader.d.ts

@@ -0,0 +1,33 @@
+/** Scoped takeover of public Loader entries; no profile file is written. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const OFFICIAL_AUTO_REVIEW = "@deepseek-ai/dsh-experimental-auto-review";
+export declare const LEGACY_AUTO_REVIEW = "@dsh-electron/dsh-plugin-multi-root-auto-review";
+/**
+ * internal/plugin is emitted before Fiber checks dependencies or runs apply.
+ * Disposing there also stops an import already in flight when takeover began.
+ * The group update wrapper preserves desired configuration and drains our
+ * owner BEFORE the update that lets the official owner run again.
+ */
+export declare class AutoReviewTakeover {
+    private readonly ctx;
+    private readonly entry;
+    private readonly group;
+    private readonly restoreUpdate;
+    private readonly predecessor;
+    private readonly closed;
+    private releaseClosed;
+    readonly stopHook: () => void;
+    private desired;
+    private stopOwner;
+    private exiting;
+    private closing;
+    private readonly draining;
+    constructor(ctx: Context);
+    private isDisabled;
+    private suppress;
+    suspendOfficial(): Promise<void>;
+    /** Called before any asynchronous startup, so early unload also drains it. */
+    setOwnerDisposer(stop: () => Promise<void>): void;
+    close(restore?: boolean): Promise<void>;
+    private finish;
+}

package/lib/types/compat/auto-review-packages.d.ts

@@ -0,0 +1 @@
+export declare function assertForkPackages(): void;

package/lib/types/compat/dsh-version.d.ts

@@ -43,10 +43,43 @@ export declare const REQUIRED_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@
  * that is the mixed-installation failure this contract exists to catch.
  */
 export declare const OPTIONAL_CORE_PACKAGES: readonly ["@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
+/**
+ * The optional packages this plugin loads itself at run time, through dynamic
+ * `import()`s inside this package's own modules. The copy this module resolves
+ * IS the copy that would execute, so every resolvable hit testifies — a
+ * private copy inside this package's own tree genuinely loads, and a version
+ * that disagrees with the host is a real mixed installation, not a phantom.
+ */
+export declare const RUNTIME_OPTIONAL_PACKAGES: readonly ["@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-typert-protocol"];
+/**
+ * The optional packages this plugin consumes only as mounted host services or
+ * ambient types — it never imports them, so a copy inside this package's own
+ * tree can never execute. The only version that testifies is the one the
+ * COMPOSITION resolves (the installation or the profile): a resolution that
+ * lands inside this package's own root is a private development or bundled
+ * copy and must be reported absent — otherwise a `link:`-installed checkout
+ * whose devDependencies carry a newer release phantom-mixes every supported
+ * host it is developed against (the report that motivated this split:
+ * `dsh-lsp`/`dsh-lsp-stdio`/`dsh-working-directory` resolving to the plugin's
+ * devDependencies on a `0.2.0-rc.2` host produced a `mixed` verdict on a
+ * uniformly `0.2.0-rc.2` installation).
+ */
+export declare const HOST_SERVICE_PACKAGES: readonly ["@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory"];
+/**
+ * Optional packages this plugin executes that are resolved through an anchor
+ * OTHER than this module. The standalone Windows ACL runner
+ * (`src/windows-runner.ts`) imports `@deepseek-ai/dsh-sandbox-windows-acl` by
+ * self-reference from the upstream runner's own install location — a file the
+ * installed `dsh-sandbox-local` points at in its confined argv — so the copy
+ * that testifies is the one sibling to that required package, not whatever
+ * this module can reach. Neither the self-resolution hit nor the
+ * `@deepseek-ai/dsh` host anchor reflects execution here: if sandbox-local's
+ * own anchor cannot see the package, the runner cannot load it either, and
+ * absent is the honest answer.
+ */
+export declare const RUNNER_ANCHORED_PACKAGES: readonly ["@deepseek-ai/dsh-sandbox-windows-acl"];
 /** Every package the contract inspects, required first. */
 export declare const CORE_PACKAGES: readonly ["@deepseek-ai/dsh-fs", "@deepseek-ai/dsh-fs-local", "@deepseek-ai/dsh-sandbox", "@deepseek-ai/dsh-sandbox-local", "@deepseek-ai/dsh-sandbox-policy", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-tools", "@deepseek-ai/dsh-working-directory", "@deepseek-ai/dsh-lsp", "@deepseek-ai/dsh-lsp-stdio", "@deepseek-ai/dsh-api-workspace-files", "@deepseek-ai/dsh-typert-protocol", "@deepseek-ai/dsh-sandbox-windows-acl", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-client-connection", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-subprocess", "@deepseek-ai/dsh-system-prompt"];
-/** Services looked up structurally; older runtimes never install these modules. */
-export declare const HOST_RESOLVED_PACKAGES: readonly ["@deepseek-ai/dsh-working-directory"];
 /** How this plugin reacts to an installation it does not support. */
 export type CompatEnforcement = 'enforce' | 'warn';
 /** The environment variable that relaxes the gate. */
@@ -85,12 +118,27 @@ export type VersionReader = (packageName: string) => string | undefined;
 /**
  * Read one package's declared version through Node resolution.
  *
- * Resolution runs from THIS module, which is what makes the answer meaningful:
- * the upstream packages are peer dependencies, so they resolve to the single
- * copy the host provides — the same copy the providers will subclass at
- * runtime. A package that cannot be resolved is reported absent rather than
- * throwing, because "not installed" is a legitimate answer for every optional
- * package.
+ * Resolution runs from THIS module — for required and runtime-loaded packages
+ * the copy found here is the copy that would execute, which is what makes the
+ * answer meaningful: the upstream packages are peer dependencies, so they
+ * resolve to the single copy the host provides — the same copy the providers
+ * will subclass at runtime.
+ *
+ * {@link HOST_SERVICE_PACKAGES} are different: the plugin never imports them,
+ * so a copy inside this package's own tree can never execute, and counting it
+ * would report a mixed installation out of a linked checkout's devDependencies
+ * alone. Only a hit OUTSIDE this package's root — a copy the composition could
+ * mount — testifies; when this module cannot reach the package at all, the
+ * `@deepseek-ai/dsh` host manifest supplies a second anchor for host-internal
+ * packages that are never plugin peers.
+ *
+ * {@link RUNNER_ANCHORED_PACKAGES} are a third policy: executed, but resolved
+ * from the upstream-runner anchor rather than this module, so only a hit
+ * sibling to the installed `dsh-sandbox-local` testifies.
+ *
+ * A package that cannot be resolved in either place is reported absent rather
+ * than throwing, because "not installed" is a legitimate answer for every
+ * optional package.
  * @param packageName - the package to inspect.
  * @returns the declared version, or `undefined` when the package or its
  *   manifest cannot be resolved.

package/lib/types/compat/instruction-activity.d.ts

@@ -0,0 +1,17 @@
+export type FileActivity = {
+    kind: 'start';
+    id: string;
+    name: string;
+    arguments: string;
+} | {
+    kind: 'end';
+    id: string;
+    failed: boolean;
+};
+export declare function ptcFileActivity(event: unknown): FileActivity | undefined;
+/** Rebuild read-only discovery candidates from successful durable activity after resume. */
+export declare function replayedInstructionTargets(events: readonly unknown[], origin: string | undefined): readonly string[];
+/** fs tools whose success touches the file at their `file_path` argument. */
+export declare const FILE_TOUCH_TOOL_NAMES: Record<string, true>;
+/** One explicit fs-tool target, shared with live touch capture. */
+export declare function touchedPathOfToolCall(name: string, argumentsJson: string): string | undefined;

package/lib/types/compat/pty-marker.d.ts

@@ -21,7 +21,7 @@
  * Resolution follows the optional-peer precedent (`agent-instructions.ts`):
  * the backend is not a peer of this plugin, so the plugin anchor is tried
  * first (flat layouts) and the `@deepseek-ai/dsh` host anchor second — the
- * same `HOST_RESOLVED_PACKAGES` pattern as `dsh-version.ts` — because the
+ * same host-anchor fallback pattern as `dsh-version.ts` — because the
  * backend rides inside the harness meta package's own dependency tree.
  *
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/compat/pty-marker

package/lib/types/compat/review-session.d.ts

@@ -0,0 +1,2 @@
+import type { Session } from '@deepseek-ai/dsh-session';
+export declare function nativeInstructionFingerprint(session: Session): string;

package/lib/types/compat.d.ts

@@ -2,16 +2,26 @@
  * `multi-root-compat`: the startup gate that turns the DSH compatibility
  * contract from documentation into a precondition.
  *
- * The four security-relevant rows of this bundle — `multi-root-fs`,
- * `multi-root-sandbox`, `multi-root-registry`, `multi-root-instructions` —
- * inject `multiRootCompat`. Cordis will not start a plugin whose injected
- * service is absent, so this row is what decides whether they run at all:
+ * Every widened-authority row of this bundle — `multi-root-providers`,
+ * `multi-root-registry`, `multi-root-instructions`, `multi-root-lsp`,
+ * `multi-root-workspace-files`, `multi-root-process-fence` — injects
+ * `multiRootCompat`. Cordis will not start a plugin whose injected service is
+ * absent, so this row is what decides whether they run at all:
  *
  * ```text
- * compat check passes  →  ctx.multiRootCompat exists  →  the providers start
+ * compat check passes  →  ctx.multiRootCompat exists  →  the gated rows start
  * compat check fails   →  the row throws             →  they never start
  * ```
  *
+ * The two PROVIDER rows (`multi-root-fs`, `multi-root-sandbox`) deliberately
+ * do NOT inject the gate: their widening is scope-driven, and the gated
+ * registry can never populate the scope on a refused installation — so they
+ * degenerate to the upstream providers. That is what keeps a refused gate a
+ * loud degradation (the plugin's features absent, the profile intact) instead
+ * of a dead profile: upstream `fs-sandbox`/`sandbox` are already disabled by
+ * the patch, so holding `ctx.fs`/`ctx.sandbox` back would take `ctx.shell`,
+ * `permissionPresets` and every confining tool down with them.
+ *
  * That is why the gate is a plain `apply` and not a `Service` subclass mounted
  * directly: the check has to be able to fail BEFORE the service exists. A
  * `Service` constructor has already run `super(ctx, name)` — and therefore

package/lib/types/index.d.ts

@@ -21,7 +21,7 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace
  */
 export { DshCompatUnsupportedError, MultiRootCompatService, assertSupportedInstallation } from './compat.ts';
-export { classifyInstallation, compatEnforcement, CORE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
+export { classifyInstallation, compatEnforcement, CORE_PACKAGES, HOST_SERVICE_PACKAGES, OPTIONAL_CORE_PACKAGES, readInstalledVersion, REQUIRED_CORE_PACKAGES, RUNNER_ANCHORED_PACKAGES, RUNTIME_OPTIONAL_PACKAGES, SUPPORTED_DSH_RELEASES, } from './compat/dsh-version.ts';
 export type { CompatEnforcement, CompatReport, CompatVerdict, InspectedPackage, SupportedDshRelease, VersionReader, } from './compat/dsh-version.ts';
 export { instructionsApi, renderInstructions } from './compat/agent-instructions.ts';
 export type { InstructionsApi, RenderedInstructions } from './compat/agent-instructions.ts';

package/lib/types/instructions.d.ts

@@ -46,6 +46,23 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/instructions
  */
 import { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootInstructions: {
+            knownRoots(session: object): readonly string[];
+            snapshot(agent: Agent, roots: readonly string[], target: string | undefined, signal: AbortSignal): Promise<readonly CurrentRootInstruction[]>;
+        };
+    }
+}
+/** Current constraints; never delivery deltas or authorization. */
+export interface CurrentRootInstruction {
+    readonly root: string;
+    readonly path: string;
+    readonly relativeDirectory: string;
+    readonly digest: string;
+    readonly text: string;
+}
 /** The `plugin` attribution every message this row produces carries. */
 export declare const PLUGIN_SOURCE = "@dsh-electron/dsh-plugin-multi-root-workspace";
 /**
@@ -91,7 +108,7 @@ export interface RemovedScope {
  * @param argumentsJson - the tool call's raw arguments, exactly as produced.
  * @returns the trimmed absolute-or-relative path, or `undefined`.
  */
-export declare function touchedPathOfToolCall(name: string, argumentsJson: string): string | undefined;
+export { touchedPathOfToolCall } from './compat/instruction-activity.ts';
 /**
  * Compose the model-facing message body for one batch of changes.
  *

package/lib/types/review-context.d.ts

@@ -0,0 +1,49 @@
+import { Context, Service } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { CurrentRootInstruction } from './instructions.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootReviewContext: MultiRootReviewContext;
+    }
+}
+export interface ReviewExecution {
+    readonly agent?: Agent;
+    readonly name: string;
+    readonly arguments: unknown;
+}
+export interface ReviewContext {
+    readonly schemaVersion: 1;
+    readonly environment: {
+        readonly sessionOrigin: string;
+        readonly effectiveCwd: string;
+        readonly sandboxMode: string;
+        readonly registryAuthority: 'available' | 'unavailable';
+        readonly roots: readonly {
+            readonly path: string;
+            readonly access: string;
+            readonly effectiveWritable: boolean;
+        }[];
+        readonly writableRoots: readonly string[];
+        readonly deniedRoots: readonly string[];
+        readonly protectedHome?: string;
+        /** Full access permits unregistered paths subject to the existing deny fence. */
+        readonly ambientWrites: boolean;
+        readonly readConfinement: false;
+        readonly primaryRootWritable: boolean;
+        readonly writeBoundary: string;
+    };
+    /** Provenance from current scope and the existing delivery index; never a grant. */
+    readonly instructionProvenanceRoots: readonly string[];
+    readonly constraints: readonly CurrentRootInstruction[];
+    readonly completeness: 'complete';
+    readonly fingerprint: string;
+}
+/** All authority remains in the existing Registry/scope and instruction index. */
+export declare class MultiRootReviewContext extends Service {
+    static inject: string[];
+    constructor(ctx: Context);
+    assertCompatible(): void;
+    build(exec: ReviewExecution, signal: AbortSignal): Promise<ReviewContext>;
+    assertCurrent(exec: ReviewExecution, snapshot: ReviewContext, signal: AbortSignal): Promise<void>;
+}
+export default MultiRootReviewContext;

package/lib/types/scope.d.ts

@@ -245,6 +245,11 @@ export declare class MultiRootScopeService extends Service {
      * @returns the canonical scope; `additionalRoots` is empty when none are registered.
      */
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
+    /** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
+    previewForTool(policy: SandboxExecutionPolicy, toolName: string): FilesystemScope;
+    /** Execution and review use exactly the same parent-narrowing rule. */
+    private capForTool;
+    private project;
     /**
      * Whether THIS call's additional-root writes are capped. Inside a tool
      * dispatch the AsyncLocalStorage store answers; outside any dispatch (user

package/lib/windows-runner.js

@@ -1,8 +1,8 @@
-import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, o as rootDenySid, r as canonicalPath, s as workspaceScopeSid } from "./windows-runner-contract-CEfmZzu0.js";
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, o as rootDenySid, r as canonicalPath, s as workspaceScopeSid } from "./windows-runner-contract-B5R2K3mM.js";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, win32 } from "node:path";
 import { createHash } from "node:crypto";
+import { basename, dirname, isAbsolute, join, win32 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createConnection } from "node:net";
 //#region src/compat/windows-native.ts

package/lib/workspace-files.js

@@ -1,6 +1,6 @@
-import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
 import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
+import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
 import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -62,6 +62,14 @@
     "./windows-runner": {
       "types": "./lib/types/windows-runner.d.ts",
       "default": "./lib/windows-runner.js"
+    },
+    "./review-context": {
+      "types": "./lib/types/review-context.d.ts",
+      "default": "./lib/review-context.js"
+    },
+    "./auto-review": {
+      "types": "./lib/types/auto-review/entry.d.ts",
+      "default": "./lib/auto-review.js"
     }
   },
   "files": [
@@ -75,7 +83,11 @@
     "CHANGELOG.en.md",
     "LICENSE",
     "scripts/windows-broker/*.ps1",
-    "scripts/windows-broker/*.cs"
+    "scripts/windows-broker/*.cs",
+    "src/auto-review/FORK.md",
+    "src/auto-review/LICENSE",
+    "src/auto-review/README.md",
+    "src/auto-review/README.en.md"
   ],
   "publishConfig": {
     "access": "public"
@@ -109,7 +121,9 @@
     "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
     "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
     "@deepseek-ai/dsh-tools": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-permission-presets": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent": {
@@ -153,6 +167,12 @@
     },
     "@deepseek-ai/dsh-tools": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-permission-presets": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-util-values": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -212,7 +232,25 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.8",
     "yaml": "^2.9.0",
-    "zustand": "~4.5.7"
+    "zustand": "~4.5.7",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-compaction": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-permission-presets": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-shell": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-bash": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.2"
   },
   "dsh": {
     "bundle": {
@@ -236,7 +274,7 @@
   "scripts": {
     "bench:roots": "node --experimental-transform-types scripts/bench-root-scale.mjs",
     "build": "pnpm run build:types && pnpm run bundle",
-    "build:types": "tsc -p tsconfig.host.json && tsc -p tsconfig.client.json",
+    "build:types": "tsc -p tsconfig.host.json && tsc -p tsconfig.client.json && node scripts/build-auto-review.mjs",
     "bundle": "node scripts/clean-lib.mjs && tsdown",
     "compat:check": "node scripts/check-dsh-compat.mjs",
     "docs:check": "node scripts/check-docs.mjs",
@@ -251,7 +289,9 @@
     "smoke:packed": "node scripts/smoke-packed.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc -p tsconfig.host.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke && pnpm pack:check && pnpm smoke:packed"
+    "typecheck": "tsc -p tsconfig.host.json --noEmit && tsc -p tsconfig.client.json --noEmit && node scripts/build-auto-review.mjs",
+    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke && pnpm pack:check && pnpm smoke:packed && pnpm auto-review:fork && pnpm smoke:auto-review",
+    "auto-review:fork": "node scripts/check-auto-review-fork.mjs",
+    "smoke:auto-review": "node scripts/verify-auto-review.mjs"
   }
 }

package/src/auto-review/FORK.md

@@ -0,0 +1,26 @@
+# Auto Review fork
+
+基线：DeepSeek Harness `dsh-v0.2.1-rc.2`，commit `687f282e8625c6b8d11ff58211a90524be2e4317`，`packages/experimental/auto-review/src/index.ts`。原文件保存在 `upstream.ts`；MIT 许可保存在 `LICENSE`。
+
+允许差异：兼容层身份及必需服务；调用只读宿主 context builder；环境数据及当前 constraint 数据；native 副本的 metadata/digest 校验与去重；发送前、模型等待后、后续 gate 后和 dispatch 前的失败关闭/陈旧校验。dispatch 复核使用 registry token，涵盖人工批准等待，并随 owner 生命周期取消和 drain。
+
+风险 policy、human/direct-parent/checkpoint/fact 角色判定、native/PTC 身份、严格输出协议、ask/never、下游 gate 与卸载时 Session 迁移保持官方语义。新增当前项目文本没有授权身份。没有全局 LLM hook、提示词文本匹配或第二 reviewer。
+
+同步：先核对发布包与 tag 源码；人工审阅上游 policy、身份与 lifecycle 差异；更新 `upstream.ts` 和基线哈希；重放最小 context 差异；更新 `fork.patch`；运行差分门禁、官方回归、联合工具/装配/packed 与原生内核验证。绿色测试不能自动扩大联合支持版本。正式 context contribution API 足够后迁移 collector，移除 fork，保留联合测试。
+
+Native 协调只使用现有 scope/delivery 索引证明的附加根来源；纯附加根旧帧留作 fact，以新快照替代。混合 native 帧若含陈旧的附加文件，公开接口不足以无损拆出 global/primary 正文，故拒绝本次审查并要求刷新 baseline。未登记 cwd 的 native 项目约束保持官方身份。
+
+
+逐文件维护范围：
+
+| 文件 | 来源/职责 |
+|---|---|
+| `upstream.ts` | 原始官方入口，哈希固定，不能当实现文件编辑 |
+| `fork.ts` / `fork.patch` | 可执行 fork / 人工审阅的唯一入口差异 |
+| `context.ts` | 当前 native baseline、scope metadata、历史 fact 与新鲜 constraint 分区 |
+| `../compat/auto-review-packages.ts` | 精确执行副本门禁 |
+| `../../tests/auto-review/upstream.spec.ts` / `../../tests/auto-review/parent.ts` | 同一 commit 的官方回归和 parent fixture；只调整导入、context stub 及新增环境字段断言 |
+| `entry.ts` / `../compat/auto-review-loader.ts` | 单开关的 context/owner 生命周期、运行时接管与恢复 |
+| `../../tests/auto-review/` 与 joint smoke | 上下文、工具、接管、启停和单包安装验证 |
+
+主包的 `review-context` 与 instructions facade 是本地接口，不是上游正式 API。不再有独立 companion manifest 或主包 peer；普通 allowlist 的提升不能代替 fork 的同步和联合验收。

package/src/auto-review/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/auto-review/README.en.md

@@ -0,0 +1,22 @@
+# Optional Auto Review
+
+中文：[README.md](./README.md)
+
+Auto Review is included at `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` and supports only DSH `0.2.1-rc.2`. After installing the main package, expand Multi-root Workspace's row list in the Plugin Manager and enable the `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` row (its `cordis.patch.yml` row id is `multi-root-auto-review`). This row ships disabled: while off, it mounts neither the reviewer nor review context and does not register the Auto preset. Profiles without hot reload require a restart, as reported by the manager.
+
+The one switch mounts both current multi-root context and the reviewer, taking over the sibling official `@deepseek-ai/dsh-experimental-auto-review` row at runtime. Either bundle order works, and subsequent reloads retain one owner. Takeover does not change the official row's saved configuration. After disabling, reload/restart restores the official owner only if its bundle is still selected and its original configuration allows it to run; an unselected official bundle is not installed or enabled automatically. When the official bundle is not selected, the row still provides the same reviewer standalone (it registers the Auto preset itself); there is simply no official owner to take over.
+
+Alternatively, set this in the profile's `cordis.patch.yml`:
+
+```yaml
+- id: multi-root-auto-review
+  disabled: false
+```
+
+Unloading a live Auto owner preserves official behavior: Auto sessions move to Full access, and a replacement owner does not automatically switch them back. Select Auto again in the session when needed. Multi-root write fences remain enforced.
+
+To migrate from the former companion, stop the profile, remove its bundle selection and `@dsh-electron/dsh-plugin-multi-root-auto-review` dependency, then install/update the main package and enable the row above. The existing `dsh plugin --profile <name> remove @dsh-electron/dsh-plugin-multi-root-auto-review` command can remove the old package; preserve the official bundle's existing selection. The old configure command is retired. Coexistence with a selected legacy companion produces an explicit startup diagnostic and never silently rewrites the user's manifest.
+
+Constraint roles, budgets, mixed native frames, and freshness retain the existing fork semantics: current topology and instructions enter the reviewer's data sections; project text only constrains actions. Budget, I/O, cancellation, or snapshot changes fail that call. bash/pwsh collection covers known directory chains and cannot infer every target of an arbitrary script. Automatic source-file reading remains outside scope.
+
+See [FORK.md](./FORK.md) for the baseline, permitted differences, and synchronization procedure.

package/src/auto-review/README.md

@@ -0,0 +1,22 @@
+# 可选 Auto Review
+
+English: [README.en.md](./README.en.md)
+
+Auto Review 已内置于 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review`，仅支持 DSH `0.2.1-rc.2`。安装主包后，在插件管理器中展开 Multi-root Workspace 的行列表，打开 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` 行（`cordis.patch.yml` 中的行 id 为 `multi-root-auto-review`）。该行出厂关闭；关闭时不挂载 reviewer 或 review context，也不注册 Auto preset。无热重载的 profile 需要按管理器提示重启。
+
+启用后，同一个开关挂载当前多根 context 与 reviewer，并在运行时停止同组官方 `@deepseek-ai/dsh-experimental-auto-review` 行。官方 bundle 位于主包前后均可；后续 reload 仍保持单一 owner。接管不修改官方的持久配置。关闭后，官方仅在仍被选择且原配置允许启用时随 reload/restart 恢复；官方未被选择时不会自动安装或启用。官方 bundle 未被选择时，该行仍独立提供同一份 reviewer（自带注册 Auto preset），只是没有可接管的官方 owner。
+
+也可在 profile 的 `cordis.patch.yml` 中显式设置：
+
+```yaml
+- id: multi-root-auto-review
+  disabled: false
+```
+
+卸载任何存活的 Auto owner 都保留官方语义：Auto Session 迁移为 Full access；新 owner 不会自动把它们切回 Auto。需要继续使用 Auto 时，在 Session 中重新选择。Multi-root 的写围栏继续执行。
+
+从旧 companion 迁移时，先停止目标 profile，移除其 bundle 选择和 `@dsh-electron/dsh-plugin-multi-root-auto-review` 依赖，再安装/更新主包并打开上述行。可使用现有 `dsh plugin --profile <name> remove @dsh-electron/dsh-plugin-multi-root-auto-review` 清理旧包；保留官方 bundle 的原有选择。旧版 configure 不再使用。残留旧 companion 与内置入口共存时会明确拒绝启动，不会自动重写用户 manifest。
+
+约束、预算、混合 native 帧与 freshness 语义沿用原 fork：当前拓扑和指令进入 reviewer 数据分区，项目文本仅为 constraint；预算、I/O、取消或快照变化使本次调用失败。bash/pwsh 只收集已知目录链，不能推断任意脚本的全部目标；普通源码自动读取不在范围内。
+
+Fork 基线、允许差异与同步规则见 [FORK.md](./FORK.md)。

package/lib/{registry-lease-win32-DTO6QpT9.js → registry-lease-win32-DVTq9d4D.js}

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
 import { createHash } from "node:crypto";
+import { basename, dirname, join, resolve } from "node:path";
 //#region src/registry-lease-win32.ts
 /**
 * Windows named-kernel-semaphore adapter for the registry authority lease.