@yadsh/dsh-session-scope 0.5.0

package/lib/scope-context.js

@@ -0,0 +1,29 @@
+export function renderSessionScopeContext(scope) {
+    if (scope.mode === "full") {
+        return [
+            "### Session workspace scope",
+            "",
+            "The entire session workspace is accessible. Filesystem effects are still controlled by the active permission policy.",
+        ].join("\n");
+    }
+    const roots = scope.roots.length === 0
+        ? ["- none (filesystem access is fail-closed until the scope is changed)"]
+        : scope.roots.map((root) => `- ${root}`);
+    const shell = scope.mode === "isolated"
+        ? "Supported shell processes are also confined to this view."
+        : "DSH filesystem tools are restricted; shell isolation is not guaranteed in focused mode.";
+    return [
+        "### Session workspace scope",
+        "",
+        `The current session uses ${scope.mode} workspace scope.`,
+        "",
+        "Accessible roots:",
+        ...roots,
+        "",
+        "Treat all other paths under the session workspace as unavailable.",
+        "Do not search, inspect, read, modify, or execute against paths outside these roots.",
+        "If another workspace area is required, ask the user to change the session scope.",
+        shell,
+    ].join("\n");
+}
+//# sourceMappingURL=scope-context.js.map

package/lib/scope-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-context.js","sourceRoot":"","sources":["../src/scope-context.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,yBAAyB,CAAC,KAA4B;IACpE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO;YACL,6BAA6B;YAC7B,EAAE;YACF,sHAAsH;SACvH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACpC,CAAC,CAAC,CAAC,sEAAsE,CAAC;QAC1E,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU;QACrC,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,yFAAyF,CAAC;IAC9F,OAAO;QACL,6BAA6B;QAC7B,EAAE;QACF,4BAA4B,KAAK,CAAC,IAAI,mBAAmB;QACzD,EAAE;QACF,mBAAmB;QACnB,GAAG,KAAK;QACR,EAAE;QACF,mEAAmE;QACnE,qFAAqF;QACrF,kFAAkF;QAClF,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/lib/scope-delegation.d.ts

@@ -0,0 +1,23 @@
+import { type SessionEvent } from "./core.js";
+import { SESSION_SCOPE_EVENT, type SessionHeader, type SessionScopeEventData } from "./session-scope.js";
+export interface DelegatedSessionHeader extends SessionHeader {
+    id?: string;
+    parentSession?: string;
+    seedLength?: number;
+    origin?: "subagent";
+}
+export interface DelegatedScopeSession {
+    header: DelegatedSessionHeader;
+    events: readonly SessionEvent[];
+    append(type: typeof SESSION_SCOPE_EVENT, data: SessionScopeEventData): unknown;
+}
+export type ParentSessionResolver = (id: string) => DelegatedScopeSession | undefined;
+/**
+ * Persist a subagent's parent scope before the child can execute.
+ *
+ * A forked child prefers the immutable seed prefix, which captures the scope
+ * at the fork boundary. A fresh child resolves its live parent. Resumed
+ * children already carry their own delegation snapshot and are left alone.
+ */
+export declare function initializeDelegatedSessionScope(child: DelegatedScopeSession, resolveParent: ParentSessionResolver): SessionScopeEventData | undefined;
+//# sourceMappingURL=scope-delegation.d.ts.map

package/lib/scope-delegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-delegation.d.ts","sourceRoot":"","sources":["../src/scope-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAEL,mBAAmB,EAKnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,MAAM,CAAC,IAAI,EAAE,OAAO,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;CAChF;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,qBAAqB,GAAG,SAAS,CAAC;AAwBtF;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,qBAAqB,EAC5B,aAAa,EAAE,qBAAqB,GACnC,qBAAqB,GAAG,SAAS,CAgCnC"}

package/lib/scope-delegation.js

@@ -0,0 +1,49 @@
+import { SELECTION_EVENT, canonicalPath } from "./core.js";
+import { SESSION_SCOPE_ERROR, SESSION_SCOPE_EVENT, SessionScopeError, createSessionScopeEvent, effectiveSessionScope, } from "./session-scope.js";
+function hasScopeSnapshot(events) {
+    return events.some((event) => event.type === SESSION_SCOPE_EVENT);
+}
+function hasInheritedScopeState(events) {
+    return events.some((event) => event.type === SESSION_SCOPE_EVENT || event.type === SELECTION_EVENT);
+}
+function inheritedSeedScope(session) {
+    const seedLength = session.header.seedLength ?? 0;
+    if (seedLength <= 0)
+        return undefined;
+    const inherited = session.events.slice(0, seedLength);
+    return hasInheritedScopeState(inherited)
+        ? effectiveSessionScope(inherited, session.header)
+        : undefined;
+}
+function hasOwnScopeSnapshot(session) {
+    const ownStart = session.header.seedLength ?? 0;
+    return hasScopeSnapshot(session.events.slice(ownStart));
+}
+/**
+ * Persist a subagent's parent scope before the child can execute.
+ *
+ * A forked child prefers the immutable seed prefix, which captures the scope
+ * at the fork boundary. A fresh child resolves its live parent. Resumed
+ * children already carry their own delegation snapshot and are left alone.
+ */
+export function initializeDelegatedSessionScope(child, resolveParent) {
+    if (child.header.origin !== "subagent" || hasOwnScopeSnapshot(child))
+        return undefined;
+    let scope = inheritedSeedScope(child);
+    if (scope === undefined) {
+        const parentId = child.header.parentSession;
+        const parent = parentId === undefined ? undefined : resolveParent(parentId);
+        if (parent === undefined) {
+            throw new SessionScopeError(SESSION_SCOPE_ERROR.PARENT_UNAVAILABLE, "The parent session scope is unavailable.");
+        }
+        scope = effectiveSessionScope(parent.events, parent.header);
+    }
+    const childWorkspace = child.header.cwd ?? "";
+    if (!childWorkspace || canonicalPath(scope.workspaceRoot) !== canonicalPath(childWorkspace)) {
+        throw new SessionScopeError(SESSION_SCOPE_ERROR.PARENT_UNAVAILABLE, "The parent session scope does not match the child workspace.");
+    }
+    const event = createSessionScopeEvent(scope.mode, scope.mode === "full" ? [] : scope.roots, childWorkspace, "delegation");
+    child.append(SESSION_SCOPE_EVENT, event);
+    return event;
+}
+//# sourceMappingURL=scope-delegation.js.map

package/lib/scope-delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-delegation.js","sourceRoot":"","sources":["../src/scope-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAqB,MAAM,WAAW,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GAItB,MAAM,oBAAoB,CAAC;AAiB5B,SAAS,gBAAgB,CAAC,MAA+B;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA+B;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA8B;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IAClD,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtD,OAAO,sBAAsB,CAAC,SAAS,CAAC;QACtC,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA8B;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IAChD,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAA4B,EAC5B,aAAoC;IAEpC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvF,IAAI,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CACzB,mBAAmB,CAAC,kBAAkB,EACtC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,cAAc,IAAI,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,iBAAiB,CACzB,mBAAmB,CAAC,kBAAkB,EACtC,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,CACnC,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EACxC,cAAc,EACd,YAAY,CACb,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/scope-fs.d.ts

@@ -0,0 +1,47 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { ScopeSession } from "./host-api.js";
+import type { ScopeToolExecution } from "./tool-guard.js";
+export interface ScopeFsTarget {
+    targetKey: unknown;
+    displayPath: string;
+}
+export interface ScopeFsDirEntry {
+    name: string;
+    type: "file" | "directory" | "other";
+    target: ScopeFsTarget;
+    [key: string]: unknown;
+}
+export interface ScopeAwareFileSystem {
+    resolve(path: string, options?: {
+        cwd?: string;
+        signal?: AbortSignal;
+    }): Promise<ScopeFsTarget>;
+    contains(parent: ScopeFsTarget, child: ScopeFsTarget): boolean;
+    stat(target: ScopeFsTarget, signal?: AbortSignal): Promise<unknown>;
+    lstat(path: string, options?: {
+        cwd?: string;
+    }, signal?: AbortSignal): Promise<unknown>;
+    readText(target: ScopeFsTarget, signal?: AbortSignal): Promise<string>;
+    streamText(target: ScopeFsTarget, signal?: AbortSignal): Promise<AsyncIterable<string>>;
+    readBytes(target: ScopeFsTarget, signal: AbortSignal | undefined, maxBytes: number): Promise<Uint8Array>;
+    listDir(target: ScopeFsTarget, signal?: AbortSignal): Promise<ScopeFsDirEntry[]>;
+    writeText(target: ScopeFsTarget, ...args: unknown[]): Promise<unknown>;
+    editText(target: ScopeFsTarget, ...args: unknown[]): Promise<unknown>;
+}
+interface SessionScopeRuntimeContext {
+    session: ScopeSession;
+    execution?: ScopeToolExecution;
+}
+export declare class SessionScopeRuntime {
+    readonly storage: AsyncLocalStorage<SessionScopeRuntimeContext>;
+    private readonly cache;
+    run<T>(session: ScopeSession | undefined, operation: () => T, execution?: ScopeToolExecution): T;
+    currentSession(): ScopeSession | undefined;
+    currentExecution(): ScopeToolExecution | undefined;
+    private resolvedScope;
+    private classify;
+    private deny;
+    patchFileSystem(fs: ScopeAwareFileSystem, fallbackWorkspaceRoot?: string): () => void;
+}
+export {};
+//# sourceMappingURL=scope-fs.d.ts.map

package/lib/scope-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-fs.d.ts","sourceRoot":"","sources":["../src/scope-fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAO1D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;IACrC,MAAM,EAAE,aAAa,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChG,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzG,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjF,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAiBD,UAAU,0BAA0B;IAClC,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAID,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,OAAO,gDAAuD;IAEvE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4C;IAElE,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAG/F;IAED,cAAc,IAAI,YAAY,GAAG,SAAS,CAEzC;IAED,gBAAgB,IAAI,kBAAkB,GAAG,SAAS,CAEjD;YAEa,aAAa;IAmC3B,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,IAAI;IAIZ,eAAe,CAAC,EAAE,EAAE,oBAAoB,EAAE,qBAAqB,SAAK,GAAG,MAAM,IAAI,CA4EhF;CACF"}

package/lib/scope-fs.js

@@ -0,0 +1,150 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { getScope } from "./host-api.js";
+import { isLexicallyUnder } from "./core.js";
+import { SESSION_SCOPE_ERROR, SessionScopeError, } from "./session-scope.js";
+const DENIAL_MESSAGE = "Path is outside the active session scope. Change the session scope if access is required.";
+export class SessionScopeRuntime {
+    storage = new AsyncLocalStorage();
+    cache = new WeakMap();
+    run(session, operation, execution) {
+        if (session === undefined)
+            return operation();
+        return this.storage.run({ session, execution }, operation);
+    }
+    currentSession() {
+        return this.storage.getStore()?.session;
+    }
+    currentExecution() {
+        return this.storage.getStore()?.execution;
+    }
+    async resolvedScope(fs, session, fallbackWorkspaceRoot) {
+        const scope = getScope(session, fallbackWorkspaceRoot);
+        if (scope.mode === "full") {
+            const workspace = await fs.resolve(scope.workspaceRoot);
+            return {
+                scope,
+                workspace,
+                workspaceSpellings: [scope.workspaceRoot, session.header?.cwd ?? fallbackWorkspaceRoot],
+                content: [],
+                navigation: [],
+            };
+        }
+        const key = JSON.stringify([scope.mode, scope.workspaceRoot, scope.roots, scope.navigationRoots]);
+        const cached = this.cache.get(session);
+        if (cached?.eventCount === session.events.length && cached.key === key)
+            return cached;
+        const resolveOne = (path) => fs.resolve(path, { cwd: scope.workspaceRoot });
+        const value = {
+            scope,
+            workspace: await resolveOne(scope.workspaceRoot),
+            workspaceSpellings: [scope.workspaceRoot, session.header?.cwd ?? fallbackWorkspaceRoot],
+            content: await Promise.all(scope.roots.map(resolveOne)),
+            navigation: await Promise.all([...new Set([scope.workspaceRoot, ...scope.navigationRoots])].map(resolveOne)),
+            eventCount: session.events.length,
+            key,
+        };
+        this.cache.set(session, value);
+        return value;
+    }
+    classify(fs, resolved, target) {
+        if (resolved.scope.mode === "full")
+            return "content";
+        if (!fs.contains(resolved.workspace, target)) {
+            const originatedInsideWorkspace = resolved.workspaceSpellings.some((root) => root.length > 0 && isLexicallyUnder(target.displayPath, root));
+            return originatedInsideWorkspace ? "denied" : "content";
+        }
+        if (resolved.content.some((root) => fs.contains(root, target)))
+            return "content";
+        if (resolved.navigation.some((root) => fs.contains(root, target) && fs.contains(target, root))) {
+            return "navigation";
+        }
+        return "denied";
+    }
+    deny() {
+        throw new SessionScopeError(SESSION_SCOPE_ERROR.DENIED, DENIAL_MESSAGE);
+    }
+    patchFileSystem(fs, fallbackWorkspaceRoot = "") {
+        const original = {
+            stat: fs.stat.bind(fs),
+            lstat: fs.lstat.bind(fs),
+            readText: fs.readText.bind(fs),
+            streamText: fs.streamText.bind(fs),
+            readBytes: fs.readBytes.bind(fs),
+            listDir: fs.listDir.bind(fs),
+            writeText: fs.writeText.bind(fs),
+            editText: fs.editText.bind(fs),
+        };
+        const resolveCurrent = async () => {
+            const session = this.currentSession();
+            return session === undefined ? undefined : this.resolvedScope(fs, session, fallbackWorkspaceRoot);
+        };
+        fs.stat = async (target, signal) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) === "denied")
+                this.deny();
+            return original.stat(target, signal);
+        };
+        fs.lstat = async (path, options, signal) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined) {
+                const target = await fs.resolve(path, { cwd: options?.cwd ?? scope.scope.workspaceRoot, signal });
+                if (this.classify(fs, scope, target) === "denied")
+                    this.deny();
+            }
+            return original.lstat(path, options, signal);
+        };
+        fs.readText = async (target, signal) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) !== "content")
+                this.deny();
+            return original.readText(target, signal);
+        };
+        fs.streamText = async (target, signal) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) !== "content")
+                this.deny();
+            return original.streamText(target, signal);
+        };
+        fs.readBytes = async (target, signal, maxBytes) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) !== "content")
+                this.deny();
+            return original.readBytes(target, signal, maxBytes);
+        };
+        fs.listDir = async (target, signal) => {
+            const scope = await resolveCurrent();
+            if (scope === undefined || scope.scope.mode === "full")
+                return original.listDir(target, signal);
+            const access = this.classify(fs, scope, target);
+            if (access === "denied")
+                this.deny();
+            const entries = await original.listDir(target, signal);
+            if (access === "content")
+                return entries;
+            return entries.filter((entry) => scope.content.some((root) => fs.contains(entry.target, root) || fs.contains(root, entry.target)));
+        };
+        fs.writeText = async (target, ...args) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) !== "content")
+                this.deny();
+            return original.writeText(target, ...args);
+        };
+        fs.editText = async (target, ...args) => {
+            const scope = await resolveCurrent();
+            if (scope !== undefined && this.classify(fs, scope, target) !== "content")
+                this.deny();
+            return original.editText(target, ...args);
+        };
+        return () => {
+            fs.stat = original.stat;
+            fs.lstat = original.lstat;
+            fs.readText = original.readText;
+            fs.streamText = original.streamText;
+            fs.readBytes = original.readBytes;
+            fs.listDir = original.listDir;
+            fs.writeText = original.writeText;
+            fs.editText = original.editText;
+        };
+    }
+}
+//# sourceMappingURL=scope-fs.js.map

package/lib/scope-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-fs.js","sourceRoot":"","sources":["../src/scope-fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AA+C5B,MAAM,cAAc,GAAG,2FAA2F,CAAC;AAEnH,MAAM,OAAO,mBAAmB;IACrB,OAAO,GAAG,IAAI,iBAAiB,EAA8B,CAAC;IAEtD,KAAK,GAAG,IAAI,OAAO,EAA6B,CAAC;IAElE,GAAG,CAAI,OAAiC,EAAE,SAAkB,EAAE,SAA8B;QAC1F,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;IAC1C,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,EAAwB,EACxB,OAAqB,EACrB,qBAA6B;QAE7B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxD,OAAO;gBACL,KAAK;gBACL,SAAS;gBACT,kBAAkB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,qBAAqB,CAAC;gBACvF,OAAO,EAAE,EAAE;gBACX,UAAU,EAAE,EAAE;aACf,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC;QACtF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACpF,MAAM,KAAK,GAAgB;YACzB,KAAK;YACL,SAAS,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC;YAChD,kBAAkB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,qBAAqB,CAAC;YACvF,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvD,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAC3B,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAC9E;YACD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YACjC,GAAG;SACJ,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,QAAQ,CAAC,EAAwB,EAAE,QAAuB,EAAE,MAAqB;QACvF,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,yBAAyB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1E,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAC9D,CAAC;YACF,OAAO,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,IAAI;QACV,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1E,CAAC;IAED,eAAe,CAAC,EAAwB,EAAE,qBAAqB,GAAG,EAAE;QAClE,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;SAC/B,CAAC;QACF,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACpG,CAAC,CAAC;QAEF,EAAE,CAAC,IAAI,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACtF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC;QACF,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,EAAE,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,EAAE,CAAC,UAAU,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,EAAE,CAAC,SAAS,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC,CAAC;QACF,EAAE,CAAC,OAAO,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChG,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3D,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CACnE,CAAC,CAAC;QACL,CAAC,CAAC;QACF,EAAE,CAAC,SAAS,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE;YACvC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,EAAE,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,OAAO,GAAG,EAAE;YACV,EAAE,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YACxB,EAAE,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC1B,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YAChC,EAAE,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACpC,EAAE,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YAClC,EAAE,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC9B,EAAE,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YAClC,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;CACF"}

package/lib/scope-processes.d.ts

@@ -0,0 +1,31 @@
+export declare const SESSION_SCOPE_PROCESS_ACTIVE_MESSAGE: string;
+export interface ScopeProcessOwner {
+    session: unknown;
+    ctx: {
+        on(event: string, listener: (...args: any[]) => unknown, options?: Record<string, unknown>): unknown;
+    };
+}
+export interface ScopeProcessJob {
+    kind?: string;
+    status?: string;
+}
+export interface ScopeProcessServices {
+    terminals?: {
+        hasOwnerActivity(owner: ScopeProcessOwner): boolean;
+    };
+    jobs?: {
+        list(owner: ScopeProcessOwner): readonly ScopeProcessJob[];
+    };
+}
+/**
+ * Tracks process launches which can retain an old isolated mount view and
+ * rejects scope changes until every such view has gone away.
+ */
+export declare class SessionScopeProcessActivity {
+    #private;
+    isProcessTool(name: string): boolean;
+    ensureFence(owner: ScopeProcessOwner, services: ScopeProcessServices): void;
+    hasActive(owner: ScopeProcessOwner, services?: ScopeProcessServices): boolean;
+    run<T>(owner: ScopeProcessOwner | undefined, toolName: string, operation: () => T | Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=scope-processes.d.ts.map

package/lib/scope-processes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-processes.d.ts","sourceRoot":"","sources":["../src/scope-processes.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oCAAoC,QACyE,CAAC;AAE3H,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE;QACH,EAAE,CACA,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,EACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC;KACZ,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE;QACV,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC;KACrD,CAAC;IACF,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,SAAS,eAAe,EAAE,CAAC;KAC5D,CAAC;CACH;AAQD;;;GAGG;AACH,qBAAa,2BAA2B;;IAItC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnC;IAED,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAiB1E;IAED,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,GAAE,oBAAyB,GAAG,OAAO,CAiBhF;IAEK,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAWhH;CACF"}

package/lib/scope-processes.js

@@ -0,0 +1,71 @@
+import { SESSION_SCOPE_ERROR, SESSION_SCOPE_EVENT, } from "./session-scope.js";
+export const SESSION_SCOPE_PROCESS_ACTIVE_MESSAGE = `${SESSION_SCOPE_ERROR.PROCESS_ACTIVE}: close persistent terminals and stop background shell jobs before changing scope`;
+const PROCESS_TOOL_NAMES = new Set(["bash", "terminal_open"]);
+const LIVE_JOB_KINDS = new Set(["bash", "pty-send"]);
+const LIVE_JOB_STATUSES = new Set(["running", "stopping"]);
+/**
+ * Tracks process launches which can retain an old isolated mount view and
+ * rejects scope changes until every such view has gone away.
+ */
+export class SessionScopeProcessActivity {
+    #activeExecutions = new WeakMap();
+    #fences = new WeakMap();
+    isProcessTool(name) {
+        return PROCESS_TOOL_NAMES.has(name);
+    }
+    ensureFence(owner, services) {
+        const existing = this.#fences.get(owner);
+        if (existing !== undefined) {
+            existing.terminals = services.terminals ?? existing.terminals;
+            existing.jobs = services.jobs ?? existing.jobs;
+            return;
+        }
+        const state = { ...services };
+        this.#fences.set(owner, state);
+        owner.ctx.on("internal/dispatch", (_mode, eventName, args) => {
+            if (eventName !== "session/event")
+                return;
+            const [session, event] = args;
+            if (session !== owner.session || event?.type !== SESSION_SCOPE_EVENT)
+                return;
+            if (!this.hasActive(owner, state))
+                return;
+            throw new Error(SESSION_SCOPE_PROCESS_ACTIVE_MESSAGE);
+        }, { global: true });
+    }
+    hasActive(owner, services = {}) {
+        if ((this.#activeExecutions.get(owner) ?? 0) > 0)
+            return true;
+        try {
+            if (services.terminals?.hasOwnerActivity(owner))
+                return true;
+        }
+        catch {
+            return true;
+        }
+        try {
+            const jobs = services.jobs?.list(owner) ?? [];
+            return jobs.some((job) => LIVE_JOB_KINDS.has(job.kind ?? "")
+                && LIVE_JOB_STATUSES.has(job.status ?? ""));
+        }
+        catch {
+            return true;
+        }
+    }
+    async run(owner, toolName, operation) {
+        if (owner === undefined || !this.isProcessTool(toolName))
+            return operation();
+        this.#activeExecutions.set(owner, (this.#activeExecutions.get(owner) ?? 0) + 1);
+        try {
+            return await operation();
+        }
+        finally {
+            const remaining = (this.#activeExecutions.get(owner) ?? 1) - 1;
+            if (remaining === 0)
+                this.#activeExecutions.delete(owner);
+            else
+                this.#activeExecutions.set(owner, remaining);
+        }
+    }
+}
+//# sourceMappingURL=scope-processes.js.map

package/lib/scope-processes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-processes.js","sourceRoot":"","sources":["../src/scope-processes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,oCAAoC,GAC/C,GAAG,mBAAmB,CAAC,cAAc,mFAAmF,CAAC;AA6B3H,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;AAC9D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AACrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,OAAO,2BAA2B;IAC7B,iBAAiB,GAAG,IAAI,OAAO,EAA6B,CAAC;IAC7D,OAAO,GAAG,IAAI,OAAO,EAA6C,CAAC;IAE5E,aAAa,CAAC,IAAY;QACxB,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,WAAW,CAAC,KAAwB,EAAE,QAA8B;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;YAC9D,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAA2B,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC3D,IAAI,SAAS,KAAK,eAAe;gBAAE,OAAO;YAC1C,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,IAAgD,CAAC;YAC1E,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,mBAAmB;gBAAE,OAAO;YAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,OAAO;YAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,KAAwB,EAAE,QAAQ,GAAyB,EAAE;QACrE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;mBAC/B,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,KAAoC,EAAE,QAAgB,EAAE,SAA+B;QAClG,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,EAAE,CAAC;QAE7E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,SAAS,KAAK,CAAC;gBAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACrD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF"}

package/lib/scope-sandbox-linux.d.ts

@@ -0,0 +1,35 @@
+import { type EffectiveSessionScope } from "./session-scope.js";
+export interface ScopeSandboxPolicy {
+    mode: "read-only" | "workspace-write" | "danger-full-access" | string;
+    workspaceRoot: string;
+    [key: PropertyKey]: unknown;
+}
+export interface ScopeConfinedArgv {
+    argv: string[];
+    enforcement: "full" | "partial" | string;
+    denialSignatures: readonly string[];
+    runnerFailureRules: readonly unknown[];
+    [key: string]: unknown;
+}
+export interface ScopeSandboxProvider {
+    confine(argv: readonly string[], policy: ScopeSandboxPolicy): ScopeConfinedArgv;
+}
+export type BwrapProbeExecutor = (argv: readonly string[]) => boolean;
+/** Same-world, non-serialized carrier added to DSH's per-call sandbox policy. */
+export declare const SESSION_SCOPE_POLICY: unique symbol;
+/** Require the exact, versioned DSH bwrap profile this plugin knows how to narrow. */
+export declare function isSupportedBwrapInvocation(confined: ScopeConfinedArgv, policy: ScopeSandboxPolicy): boolean;
+/**
+ * Probe the official provider seam. The local provider performs its own
+ * functional bwrap probe before returning this direct profile.
+ */
+export declare function detectBwrapIsolation(provider: ScopeSandboxProvider | undefined, workspaceRoot: string, platform?: NodeJS.Platform, execute?: BwrapProbeExecutor): boolean;
+/**
+ * Replace DSH's whole-workspace bwrap view with an empty workspace plus only
+ * the selected roots. Unknown argv dialects and partial enforcement fail closed.
+ */
+export declare function confineIsolatedBwrap(confined: ScopeConfinedArgv, policy: ScopeSandboxPolicy, scope: EffectiveSessionScope, requestedWorkingDirectory?: string): ScopeConfinedArgv;
+/** Attach the effective scope without changing DSH's public policy shape. */
+export declare function attachSessionScopePolicy<T extends object>(policy: T, scope: EffectiveSessionScope): T;
+export declare function sessionScopeFromPolicy(policy: object): EffectiveSessionScope | undefined;
+//# sourceMappingURL=scope-sandbox-linux.d.ts.map

package/lib/scope-sandbox-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-sandbox-linux.d.ts","sourceRoot":"","sources":["../src/scope-sandbox-linux.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,WAAW,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,MAAM,CAAC;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,kBAAkB,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,GAAG,iBAAiB,CAAC;CACjF;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;AAEtE,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,eAAyC,CAAC;AA6C3E,sFAAsF;AACtF,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,aAAa,EAAE,MAAM,EACrB,QAAQ,kBAAmB,EAC3B,OAAO,GAAE,kBAGR,GACA,OAAO,CAgBT;AAwCD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,qBAAqB,EAC5B,yBAAyB,CAAC,EAAE,MAAM,GACjC,iBAAiB,CAkDnB;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,CAErG;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAExF"}