@dsh-electron/dsh-plugin-multi-root-workspace 0.1.8 → 0.1.9

package/lib/scope.js

@@ -1,10 +1,10 @@
 import { t as aroundTool } from "./tool-context-CpgIFcCB.js";
 import { r as effectiveRootAccess } from "./contract-DZ4zczDT.js";
-import { Service } from "@deepseek-ai/cordis";
 import { statSync } from "node:fs";
 import { isAbsolute } from "node:path";
-import { AsyncLocalStorage } from "node:async_hooks";
+import { Service } from "@deepseek-ai/cordis";
 import { canonicalPath } from "@deepseek-ai/dsh-sandbox";
+import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/scope.ts
 /**
 * The multi-root workspace scope: the plugin's single home for the question
@@ -210,8 +210,7 @@ var MultiRootScopeService = class extends Service {
 		if (dshHome !== void 0 && (typeof dshHome !== "string" || dshHome.trim() === "" || !isAbsolute(dshHome))) ctx.logger.error(`multi-root-workspace: invalid dshHome config (expected an absolute path, got ${JSON.stringify(dshHome)}); the DSH-home deny boundary is disabled`);
 		else this.dshHome = dshHome;
 		aroundTool(ctx, (exec, next) => {
-			const parent = toolCapStore.getStore();
-			return toolCapStore.run({ capped: parent?.capped === true || this.caps[exec.name] === "read-only" }, next);
+			return toolCapStore.run({ capped: this.capForTool(exec.name) }, next);
 		});
 		ctx.inject(["systemPrompt", "sandboxPolicy"], (scope) => {
 			scope.systemPrompt.context({
@@ -243,9 +242,19 @@ var MultiRootScopeService = class extends Service {
 	* @returns the canonical scope; `additionalRoots` is empty when none are registered.
 	*/
 	resolve(policy) {
+		return this.project(policy, this.capped());
+	}
+	/** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
+	previewForTool(policy, toolName) {
+		return this.project(policy, this.capForTool(toolName));
+	}
+	/** Execution and review use exactly the same parent-narrowing rule. */
+	capForTool(toolName) {
+		return this.capsInvalid || toolCapStore.getStore()?.capped === true || this.caps[toolName] === "read-only";
+	}
+	project(policy, capped) {
 		const primaryRoot = canonicalPath(policy.workspaceRoot);
 		const roots = this.membersOf(primaryRoot);
-		const capped = this.capped();
 		const writable = capped || this.registryAuthority === "unavailable" ? [] : roots.filter((root) => effectivelyWritable(policy.mode, root.access)).map((root) => root.path);
 		const denied = (this.rootsByPrimary.get(primaryRoot) ?? []).filter((root) => typeof root.recordedPath === "string" && root.recordedPath !== "" && root.recordedPath !== primaryRoot && (capped || !effectivelyWritable(policy.mode, root.access))).map((root) => root.recordedPath);
 		const deniedRoots = [...new Set(denied)];

package/lib/types/auto-review/entry.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@deepseek-ai/cordis'
+/** Optional Auto Review Loader entry; supported only on DSH 0.2.1-rc.2. */
+export declare const name: string
+export declare const inject: string[]
+export declare function apply(ctx: Context): Promise<void>

package/lib/types/compat/auto-review-contract.d.ts

@@ -0,0 +1,3 @@
+/** The companion's joint support contract is deliberately narrower than the ordinary bundle. */
+export declare const AUTO_REVIEW_RELEASE = "0.2.1-rc.2";
+export declare function assertAutoReviewRelease(release: string | undefined): void;

package/lib/types/compat/auto-review-loader.d.ts

@@ -0,0 +1,33 @@
+/** Scoped takeover of public Loader entries; no profile file is written. */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const OFFICIAL_AUTO_REVIEW = "@deepseek-ai/dsh-experimental-auto-review";
+export declare const LEGACY_AUTO_REVIEW = "@dsh-electron/dsh-plugin-multi-root-auto-review";
+/**
+ * internal/plugin is emitted before Fiber checks dependencies or runs apply.
+ * Disposing there also stops an import already in flight when takeover began.
+ * The group update wrapper preserves desired configuration and drains our
+ * owner BEFORE the update that lets the official owner run again.
+ */
+export declare class AutoReviewTakeover {
+    private readonly ctx;
+    private readonly entry;
+    private readonly group;
+    private readonly restoreUpdate;
+    private readonly predecessor;
+    private readonly closed;
+    private releaseClosed;
+    readonly stopHook: () => void;
+    private desired;
+    private stopOwner;
+    private exiting;
+    private closing;
+    private readonly draining;
+    constructor(ctx: Context);
+    private isDisabled;
+    private suppress;
+    suspendOfficial(): Promise<void>;
+    /** Called before any asynchronous startup, so early unload also drains it. */
+    setOwnerDisposer(stop: () => Promise<void>): void;
+    close(restore?: boolean): Promise<void>;
+    private finish;
+}

package/lib/types/compat/auto-review-packages.d.ts

@@ -0,0 +1 @@
+export declare function assertForkPackages(): void;

package/lib/types/compat/instruction-activity.d.ts

@@ -0,0 +1,17 @@
+export type FileActivity = {
+    kind: 'start';
+    id: string;
+    name: string;
+    arguments: string;
+} | {
+    kind: 'end';
+    id: string;
+    failed: boolean;
+};
+export declare function ptcFileActivity(event: unknown): FileActivity | undefined;
+/** Rebuild read-only discovery candidates from successful durable activity after resume. */
+export declare function replayedInstructionTargets(events: readonly unknown[], origin: string | undefined): readonly string[];
+/** fs tools whose success touches the file at their `file_path` argument. */
+export declare const FILE_TOUCH_TOOL_NAMES: Record<string, true>;
+/** One explicit fs-tool target, shared with live touch capture. */
+export declare function touchedPathOfToolCall(name: string, argumentsJson: string): string | undefined;

package/lib/types/compat/review-session.d.ts

@@ -0,0 +1,2 @@
+import type { Session } from '@deepseek-ai/dsh-session';
+export declare function nativeInstructionFingerprint(session: Session): string;

package/lib/types/instructions.d.ts

@@ -46,6 +46,23 @@
  * @module @dsh-electron/dsh-plugin-multi-root-workspace/instructions
  */
 import { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootInstructions: {
+            knownRoots(session: object): readonly string[];
+            snapshot(agent: Agent, roots: readonly string[], target: string | undefined, signal: AbortSignal): Promise<readonly CurrentRootInstruction[]>;
+        };
+    }
+}
+/** Current constraints; never delivery deltas or authorization. */
+export interface CurrentRootInstruction {
+    readonly root: string;
+    readonly path: string;
+    readonly relativeDirectory: string;
+    readonly digest: string;
+    readonly text: string;
+}
 /** The `plugin` attribution every message this row produces carries. */
 export declare const PLUGIN_SOURCE = "@dsh-electron/dsh-plugin-multi-root-workspace";
 /**
@@ -91,7 +108,7 @@ export interface RemovedScope {
  * @param argumentsJson - the tool call's raw arguments, exactly as produced.
  * @returns the trimmed absolute-or-relative path, or `undefined`.
  */
-export declare function touchedPathOfToolCall(name: string, argumentsJson: string): string | undefined;
+export { touchedPathOfToolCall } from './compat/instruction-activity.ts';
 /**
  * Compose the model-facing message body for one batch of changes.
  *

package/lib/types/review-context.d.ts

@@ -0,0 +1,49 @@
+import { Context, Service } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { CurrentRootInstruction } from './instructions.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        multiRootReviewContext: MultiRootReviewContext;
+    }
+}
+export interface ReviewExecution {
+    readonly agent?: Agent;
+    readonly name: string;
+    readonly arguments: unknown;
+}
+export interface ReviewContext {
+    readonly schemaVersion: 1;
+    readonly environment: {
+        readonly sessionOrigin: string;
+        readonly effectiveCwd: string;
+        readonly sandboxMode: string;
+        readonly registryAuthority: 'available' | 'unavailable';
+        readonly roots: readonly {
+            readonly path: string;
+            readonly access: string;
+            readonly effectiveWritable: boolean;
+        }[];
+        readonly writableRoots: readonly string[];
+        readonly deniedRoots: readonly string[];
+        readonly protectedHome?: string;
+        /** Full access permits unregistered paths subject to the existing deny fence. */
+        readonly ambientWrites: boolean;
+        readonly readConfinement: false;
+        readonly primaryRootWritable: boolean;
+        readonly writeBoundary: string;
+    };
+    /** Provenance from current scope and the existing delivery index; never a grant. */
+    readonly instructionProvenanceRoots: readonly string[];
+    readonly constraints: readonly CurrentRootInstruction[];
+    readonly completeness: 'complete';
+    readonly fingerprint: string;
+}
+/** All authority remains in the existing Registry/scope and instruction index. */
+export declare class MultiRootReviewContext extends Service {
+    static inject: string[];
+    constructor(ctx: Context);
+    assertCompatible(): void;
+    build(exec: ReviewExecution, signal: AbortSignal): Promise<ReviewContext>;
+    assertCurrent(exec: ReviewExecution, snapshot: ReviewContext, signal: AbortSignal): Promise<void>;
+}
+export default MultiRootReviewContext;

package/lib/types/scope.d.ts

@@ -245,6 +245,11 @@ export declare class MultiRootScopeService extends Service {
      * @returns the canonical scope; `additionalRoots` is empty when none are registered.
      */
     resolve(policy: SandboxExecutionPolicy): FilesystemScope;
+    /** Read-only pending-dispatch projection. Does not mint an ALS execution grant. */
+    previewForTool(policy: SandboxExecutionPolicy, toolName: string): FilesystemScope;
+    /** Execution and review use exactly the same parent-narrowing rule. */
+    private capForTool;
+    private project;
     /**
      * Whether THIS call's additional-root writes are capped. Inside a tool
      * dispatch the AsyncLocalStorage store answers; outside any dispatch (user

package/lib/windows-runner.js

@@ -1,9 +1,9 @@
-import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, o as rootDenySid, r as canonicalPath, s as workspaceScopeSid } from "./windows-runner-contract-CEfmZzu0.js";
+import { a as parseWindowsProfile, i as isWindowsNetworkOrDevicePath, n as assertWindowsDenyCapacity, o as rootDenySid, r as canonicalPath, s as workspaceScopeSid } from "./windows-runner-contract-B5R2K3mM.js";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { basename, dirname, isAbsolute, join, win32 } from "node:path";
 import { pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
 import { createConnection } from "node:net";
 //#region src/compat/windows-native.ts
 /** Public Win32 process primitives, resolved from the upstream ACL installation.

package/lib/workspace-files.js

@@ -1,6 +1,6 @@
-import { l as isCanonicallyUnder } from "./roots-B-0l8mNG.js";
-import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
 import { t as wrapMethod } from "./method-wrapper-CFY3p3j2.js";
+import { l as isCanonicallyUnder } from "./roots-Ca_W1S9n.js";
+import { t as routeWorkspacePath } from "./workspace-routing-YPxaQ4V3.js";
 import { posix, resolve, win32 } from "node:path";
 //#region src/compat/workspace-files.ts
 function adaptPathWatch(service, wrap) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dsh-electron/dsh-plugin-multi-root-workspace",
   "description": "Multi-root Workspace for DeepSeek Harness: adds N additional roots to the workspace sandbox scope as an out-of-tree bundle",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -62,6 +62,14 @@
     "./windows-runner": {
       "types": "./lib/types/windows-runner.d.ts",
       "default": "./lib/windows-runner.js"
+    },
+    "./review-context": {
+      "types": "./lib/types/review-context.d.ts",
+      "default": "./lib/review-context.js"
+    },
+    "./auto-review": {
+      "types": "./lib/types/auto-review/entry.d.ts",
+      "default": "./lib/auto-review.js"
     }
   },
   "files": [
@@ -75,7 +83,11 @@
     "CHANGELOG.en.md",
     "LICENSE",
     "scripts/windows-broker/*.ps1",
-    "scripts/windows-broker/*.cs"
+    "scripts/windows-broker/*.cs",
+    "src/auto-review/FORK.md",
+    "src/auto-review/LICENSE",
+    "src/auto-review/README.md",
+    "src/auto-review/README.en.md"
   ],
   "publishConfig": {
     "access": "public"
@@ -109,7 +121,9 @@
     "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
     "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
     "@deepseek-ai/dsh-tools": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-permission-presets": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.2 || 0.1.6-alpha.1 || 0.1.6-alpha.2 || 0.1.7-alpha.1 || 0.1.7-alpha.2 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-alpha.1 || 0.2.1-alpha.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.1 || 0.2.1-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent": {
@@ -153,6 +167,12 @@
     },
     "@deepseek-ai/dsh-tools": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-permission-presets": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-util-values": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -212,7 +232,25 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.8",
     "yaml": "^2.9.0",
-    "zustand": "~4.5.7"
+    "zustand": "~4.5.7",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-compaction": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-permission-presets": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-shell": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-shell-env": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-bash": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.2"
   },
   "dsh": {
     "bundle": {
@@ -236,7 +274,7 @@
   "scripts": {
     "bench:roots": "node --experimental-transform-types scripts/bench-root-scale.mjs",
     "build": "pnpm run build:types && pnpm run bundle",
-    "build:types": "tsc -p tsconfig.host.json && tsc -p tsconfig.client.json",
+    "build:types": "tsc -p tsconfig.host.json && tsc -p tsconfig.client.json && node scripts/build-auto-review.mjs",
     "bundle": "node scripts/clean-lib.mjs && tsdown",
     "compat:check": "node scripts/check-dsh-compat.mjs",
     "docs:check": "node scripts/check-docs.mjs",
@@ -251,7 +289,9 @@
     "smoke:packed": "node scripts/smoke-packed.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc -p tsconfig.host.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke && pnpm pack:check && pnpm smoke:packed"
+    "typecheck": "tsc -p tsconfig.host.json --noEmit && tsc -p tsconfig.client.json --noEmit && node scripts/build-auto-review.mjs",
+    "verify:all": "pnpm lint && pnpm typecheck && pnpm build && pnpm kernel:probe && pnpm test && pnpm smoke && pnpm pack:check && pnpm smoke:packed && pnpm auto-review:fork && pnpm smoke:auto-review",
+    "auto-review:fork": "node scripts/check-auto-review-fork.mjs",
+    "smoke:auto-review": "node scripts/verify-auto-review.mjs"
   }
 }

package/src/auto-review/FORK.md

@@ -0,0 +1,26 @@
+# Auto Review fork
+
+基线：DeepSeek Harness `dsh-v0.2.1-rc.2`，commit `687f282e8625c6b8d11ff58211a90524be2e4317`，`packages/experimental/auto-review/src/index.ts`。原文件保存在 `upstream.ts`；MIT 许可保存在 `LICENSE`。
+
+允许差异：兼容层身份及必需服务；调用只读宿主 context builder；环境数据及当前 constraint 数据；native 副本的 metadata/digest 校验与去重；发送前、模型等待后、后续 gate 后和 dispatch 前的失败关闭/陈旧校验。dispatch 复核使用 registry token，涵盖人工批准等待，并随 owner 生命周期取消和 drain。
+
+风险 policy、human/direct-parent/checkpoint/fact 角色判定、native/PTC 身份、严格输出协议、ask/never、下游 gate 与卸载时 Session 迁移保持官方语义。新增当前项目文本没有授权身份。没有全局 LLM hook、提示词文本匹配或第二 reviewer。
+
+同步：先核对发布包与 tag 源码；人工审阅上游 policy、身份与 lifecycle 差异；更新 `upstream.ts` 和基线哈希；重放最小 context 差异；更新 `fork.patch`；运行差分门禁、官方回归、联合工具/装配/packed 与原生内核验证。绿色测试不能自动扩大联合支持版本。正式 context contribution API 足够后迁移 collector，移除 fork，保留联合测试。
+
+Native 协调只使用现有 scope/delivery 索引证明的附加根来源；纯附加根旧帧留作 fact，以新快照替代。混合 native 帧若含陈旧的附加文件，公开接口不足以无损拆出 global/primary 正文，故拒绝本次审查并要求刷新 baseline。未登记 cwd 的 native 项目约束保持官方身份。
+
+
+逐文件维护范围：
+
+| 文件 | 来源/职责 |
+|---|---|
+| `upstream.ts` | 原始官方入口，哈希固定，不能当实现文件编辑 |
+| `fork.ts` / `fork.patch` | 可执行 fork / 人工审阅的唯一入口差异 |
+| `context.ts` | 当前 native baseline、scope metadata、历史 fact 与新鲜 constraint 分区 |
+| `../compat/auto-review-packages.ts` | 精确执行副本门禁 |
+| `../../tests/auto-review/upstream.spec.ts` / `../../tests/auto-review/parent.ts` | 同一 commit 的官方回归和 parent fixture；只调整导入、context stub 及新增环境字段断言 |
+| `entry.ts` / `../compat/auto-review-loader.ts` | 单开关的 context/owner 生命周期、运行时接管与恢复 |
+| `../../tests/auto-review/` 与 joint smoke | 上下文、工具、接管、启停和单包安装验证 |
+
+主包的 `review-context` 与 instructions facade 是本地接口，不是上游正式 API。不再有独立 companion manifest 或主包 peer；普通 allowlist 的提升不能代替 fork 的同步和联合验收。

package/src/auto-review/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/auto-review/README.en.md

@@ -0,0 +1,22 @@
+# Optional Auto Review
+
+中文：[README.md](./README.md)
+
+Auto Review is included at `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` and supports only DSH `0.2.1-rc.2`. After installing the main package, expand Multi-root Workspace's row list in the Plugin Manager and enable the `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` row (its `cordis.patch.yml` row id is `multi-root-auto-review`). This row ships disabled: while off, it mounts neither the reviewer nor review context and does not register the Auto preset. Profiles without hot reload require a restart, as reported by the manager.
+
+The one switch mounts both current multi-root context and the reviewer, taking over the sibling official `@deepseek-ai/dsh-experimental-auto-review` row at runtime. Either bundle order works, and subsequent reloads retain one owner. Takeover does not change the official row's saved configuration. After disabling, reload/restart restores the official owner only if its bundle is still selected and its original configuration allows it to run; an unselected official bundle is not installed or enabled automatically. When the official bundle is not selected, the row still provides the same reviewer standalone (it registers the Auto preset itself); there is simply no official owner to take over.
+
+Alternatively, set this in the profile's `cordis.patch.yml`:
+
+```yaml
+- id: multi-root-auto-review
+  disabled: false
+```
+
+Unloading a live Auto owner preserves official behavior: Auto sessions move to Full access, and a replacement owner does not automatically switch them back. Select Auto again in the session when needed. Multi-root write fences remain enforced.
+
+To migrate from the former companion, stop the profile, remove its bundle selection and `@dsh-electron/dsh-plugin-multi-root-auto-review` dependency, then install/update the main package and enable the row above. The existing `dsh plugin --profile <name> remove @dsh-electron/dsh-plugin-multi-root-auto-review` command can remove the old package; preserve the official bundle's existing selection. The old configure command is retired. Coexistence with a selected legacy companion produces an explicit startup diagnostic and never silently rewrites the user's manifest.
+
+Constraint roles, budgets, mixed native frames, and freshness retain the existing fork semantics: current topology and instructions enter the reviewer's data sections; project text only constrains actions. Budget, I/O, cancellation, or snapshot changes fail that call. bash/pwsh collection covers known directory chains and cannot infer every target of an arbitrary script. Automatic source-file reading remains outside scope.
+
+See [FORK.md](./FORK.md) for the baseline, permitted differences, and synchronization procedure.

package/src/auto-review/README.md

@@ -0,0 +1,22 @@
+# 可选 Auto Review
+
+English: [README.en.md](./README.en.md)
+
+Auto Review 已内置于 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review`，仅支持 DSH `0.2.1-rc.2`。安装主包后，在插件管理器中展开 Multi-root Workspace 的行列表，打开 `@dsh-electron/dsh-plugin-multi-root-workspace/auto-review` 行（`cordis.patch.yml` 中的行 id 为 `multi-root-auto-review`）。该行出厂关闭；关闭时不挂载 reviewer 或 review context，也不注册 Auto preset。无热重载的 profile 需要按管理器提示重启。
+
+启用后，同一个开关挂载当前多根 context 与 reviewer，并在运行时停止同组官方 `@deepseek-ai/dsh-experimental-auto-review` 行。官方 bundle 位于主包前后均可；后续 reload 仍保持单一 owner。接管不修改官方的持久配置。关闭后，官方仅在仍被选择且原配置允许启用时随 reload/restart 恢复；官方未被选择时不会自动安装或启用。官方 bundle 未被选择时，该行仍独立提供同一份 reviewer（自带注册 Auto preset），只是没有可接管的官方 owner。
+
+也可在 profile 的 `cordis.patch.yml` 中显式设置：
+
+```yaml
+- id: multi-root-auto-review
+  disabled: false
+```
+
+卸载任何存活的 Auto owner 都保留官方语义：Auto Session 迁移为 Full access；新 owner 不会自动把它们切回 Auto。需要继续使用 Auto 时，在 Session 中重新选择。Multi-root 的写围栏继续执行。
+
+从旧 companion 迁移时，先停止目标 profile，移除其 bundle 选择和 `@dsh-electron/dsh-plugin-multi-root-auto-review` 依赖，再安装/更新主包并打开上述行。可使用现有 `dsh plugin --profile <name> remove @dsh-electron/dsh-plugin-multi-root-auto-review` 清理旧包；保留官方 bundle 的原有选择。旧版 configure 不再使用。残留旧 companion 与内置入口共存时会明确拒绝启动，不会自动重写用户 manifest。
+
+约束、预算、混合 native 帧与 freshness 语义沿用原 fork：当前拓扑和指令进入 reviewer 数据分区，项目文本仅为 constraint；预算、I/O、取消或快照变化使本次调用失败。bash/pwsh 只收集已知目录链，不能推断任意脚本的全部目标；普通源码自动读取不在范围内。
+
+Fork 基线、允许差异与同步规则见 [FORK.md](./FORK.md)。

package/lib/{compat-DR2LvmYZ.js → compat-CagUNzRB.js}

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
-import { Service } from "@deepseek-ai/cordis";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, sep } from "node:path";
+import { Service } from "@deepseek-ai/cordis";
 import { fileURLToPath } from "node:url";
 //#region src/compat/dsh-version.ts
 /**

package/lib/{fs-Nlp2AiRX.js → fs-BTXySwSG.js}

@@ -1,9 +1,9 @@
 import { brandMultiRootProvider } from "./providers.js";
 import { dirname, sep } from "node:path";
 import { writableRoots } from "@deepseek-ai/dsh-sandbox";
+import { stat } from "node:fs/promises";
 import { FsError } from "@deepseek-ai/dsh-fs";
 import { LocalFileSystem } from "@deepseek-ai/dsh-fs-local";
-import { stat } from "node:fs/promises";
 //#region src/containment.ts
 const MISSING_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
 function isMissing(error) {

package/lib/{registry-lease-win32-DTO6QpT9.js → registry-lease-win32-DVTq9d4D.js}

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
 import { createHash } from "node:crypto";
+import { basename, dirname, join, resolve } from "node:path";
 //#region src/registry-lease-win32.ts
 /**
 * Windows named-kernel-semaphore adapter for the registry authority lease.

package/lib/{windows-runner-contract-CEfmZzu0.js → windows-runner-contract-B5R2K3mM.js}

@@ -1,6 +1,6 @@
 import { existsSync, realpathSync, statSync } from "node:fs";
-import { isAbsolute, win32 } from "node:path";
 import { createHash } from "node:crypto";
+import { isAbsolute, win32 } from "node:path";
 function assertWindowsDenyCapacity(count) {
 	if (!Number.isInteger(count) || count < 1 || count > 256) throw new DialectUnrecognizedError(`Windows ambient restriction requires 1–256 deny roots including the protected DSH home; got ${count}. Reduce the registered restrictions before launching; no deny roots were dropped`);
 }