dsh-multi-folder 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Yutong Zou
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,103 @@
+# dsh-multi-folder
+
+**English** | [中文](README.zh.md)
+
+> Secondary working directories for a DeepSeek Harness project — edit a source repo, a test repo, and a docs repo side by side without leaving the primary workspace.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Node.js >= 20](https://img.shields.io/badge/Node.js-%3E%3D20-brightgreen)](https://nodejs.org/)
+
+A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin bundle that gives one project (workspace) a set of **secondary working directories**:
+
+- The agent's core `cwd` and every other core attribute keep pointing at the **primary workspace**.
+- Under **Workspace Write** mode the agent gains the **same read / write / edit / execute permissions** on the configured secondary directories as on the primary workspace — enforced by re-rooting the session's own sandbox policy, so every mode keeps its semantics (`read-only` still denies, `workspace-write` allows, `danger-full-access` allows).
+- The directory list is **injected into the system prompt** and re-rendered per session assembly.
+- Configuration changes notify the agent through a **non-interrupting message queue** — delivered at the next message boundary (user send or tool-call end), and **only when the directory set actually changed**.
+- **No new tools.** Everything is a framework-level change (tool-pipeline interception) plus a UI-level change (a session-scoped header entry).
+
+## Requirements
+
+- Node.js >= 20
+- A DSH profile composed from `@deepseek-ai/dsh-base` + `@deepseek-ai/dsh-web-app` (or an equivalent composition that provides `fs`, `sandboxPolicy`, `systemPrompt`, `commands`, `shell`, `shellEnv`, and the standard web client modules).
+
+## Install
+
+Link this repository into a DSH profile:
+
+```bash
+dsh plugin --profile web add link:<path-to-this-repo>
+```
+
+or install from npm and add `dsh-multi-folder` to the profile's `dsh.profile.bundles`:
+
+```bash
+cd <dsh-home>/profiles/web
+pnpm add dsh-multi-folder
+```
+
+Then **restart the DSH backend** (host composition loads at process start) and **refresh the browser page** (the client bundle is served `no-cache`).
+
+## Usage
+
+A **「多工作目录 / Multi-folder」** button appears in the session header. The panel lets you:
+
+| Action | Behavior |
+| ------ | -------- |
+| Add directory | Opens the native directory picker |
+| Remove / refresh | Applies immediately |
+| Switch session | The panel auto-switches to that session's directories |
+| Reopen panel | Uses the per-session cache — no redundant command rows |
+
+Equivalent slash command for the user:
+
+```
+/multi-folder list
+/multi-folder add "D:\path\to\repo"
+/multi-folder remove "D:\path\to\repo"
+/multi-folder set "D:\a" "D:\b"
+```
+
+The agent needs nothing extra: `read` / `glob` / `grep` work everywhere, and `write` / `edit` / `pwsh` / `bash` are intercepted and re-rooted automatically when the target path (or `workdir`) falls inside a configured secondary directory.
+
+## How it works
+
+- **Interception** — a listener on the `tools/execute` around-dispatch waterfall short-circuits `write` / `edit` / `pwsh` / `bash` calls whose resolved path (or `workdir`) lands inside a configured secondary directory, and executes them with the session's standing sandbox policy **re-rooted to that directory** (`{ ...standingPolicy, workspaceRoot: secondaryDir }`). The mode itself is untouched, which is what gives every sandbox mode its identical primary-workspace semantics for free. Paths are canonicalized through `fs.resolve` + `processPath` before matching, so `..`, symlinks, and case differences behave correctly.
+- **Prompt injection** — one ordered `systemPrompt` section with a text provider evaluated per assembly, rendering only for sessions whose workspace has configured directories.
+- **Notifications** — a pending notice armed by the command handler (only on actual change) is consumed at the next boundary by either the `agent/pre-step` waterfall (prepend into the entering message batch) or the `tools/post-execute` waterfall (attach as `additionalContexts`), whichever fires first — the framework's native plugin-sourced `notice` context.
+- **Configuration & security boundary** — per-workspace config lives in a host-owned store outside every agent sandbox root (`<DSH_HOME>/storages/multi-folder/<workspace-key>.json`). Direct `write`/`edit` attempts against the config file are rejected with an explicit message — **the agent can never self-grant directories; configuration is user-managed by design**. See [SECURITY.md](SECURITY.md).
+- **Client** — a hand-maintained factory bundle (`window.__ModuleLoader__.load`), no build toolchain required. The panel drives the host through the Remote BFF (`ctx.remote.commands.execute`).
+
+## Project layout
+
+| Path | Purpose |
+| ---- | ------- |
+| `cordis.patch.yml` | Profile patch layer inserting the `dsh-multi-folder` row |
+| `lib/index.js` | Host plugin: config store, tool-pipeline interception, prompt injection, dual-channel notifications, `/multi-folder` command |
+| `lib/client.js` | Client plugin (factory bundle): session-header button + overlay panel |
+| `test/` | Runtime-free behavior tests (see Development) |
+| `docs/` | Design and analysis documents |
+
+## Development
+
+No build step: the host half is plain ESM and `lib/client.js` is a hand-maintained factory bundle in the DSH client-modules format. Tests run with Node directly:
+
+```bash
+node test/smoke-host.mjs    # host apply smoke test
+node test/intercept.mjs     # interception / command / notification behavior
+node test/smoke-client.mjs  # client bundle + panel flows (React shim)
+```
+
+Before modifying `lib/client.js`, see [docs/design.md](docs/design.md) for the bundle contract.
+
+## Documentation
+
+- [docs/design.md](docs/design.md) — architecture and security model
+- 中文说明：[README.zh.md](README.zh.md)
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Issues and pull requests are welcome.
+
+## License
+
+[MIT](LICENSE)

package/README.zh.md

@@ -0,0 +1,103 @@
+# dsh-multi-folder
+
+[English](README.md) | **中文**
+
+> 为 DeepSeek Harness 项目提供**副工作目录**——不离开主工作区，同时编辑源码库、测试库与文档库。
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Node.js >= 20](https://img.shields.io/badge/Node.js-%3E%3D20-brightgreen)](https://nodejs.org/)
+
+一个 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件 bundle，为一个 Project（工作区）提供一组**副工作目录**：
+
+- Agent 的核心 `cwd` 等属性始终指向**主工作目录**；
+- 在 **Workspace Write** 模式下，Agent 对配置的副工作目录拥有与主工作目录**同等的读取、写入、编辑与命令执行权限**——实现方式是重定向会话自身的沙箱策略根，因此每种模式语义都自然保持（`read-only` 依旧拒绝、`workspace-write` 放行、`danger-full-access` 放行）；
+- 目录列表**注入系统提示词**，每次组装按会话求值；
+- 配置变更通过**不打断的消息队列**通知 Agent——在下一次消息边界（用户发送或工具调用结束）送达，且**仅在目录集合实际变化时**发送；
+- **不新增任何工具**：改动全部位于框架级（工具流水线拦截）与 UI 级（会话级头部入口）。
+
+## 环境要求
+
+- Node.js >= 20
+- 由 `@deepseek-ai/dsh-base` + `@deepseek-ai/dsh-web-app` 组成的 DSH profile（或提供 `fs`、`sandboxPolicy`、`systemPrompt`、`commands`、`shell`、`shellEnv` 及标准 Web 客户端模块的等价组合）。
+
+## 安装
+
+将本仓库链接进 DSH profile：
+
+```bash
+dsh plugin --profile web add link:<本仓库路径>
+```
+
+或从 npm 安装并把 `dsh-multi-folder` 加入 profile 的 `dsh.profile.bundles`：
+
+```bash
+cd <dsh-home>/profiles/web
+pnpm add dsh-multi-folder
+```
+
+然后**重启 DSH 后端**（宿主组合在进程启动时装载）并**刷新浏览器页面**（客户端 bundle 以 `no-cache` 提供）。
+
+## 使用
+
+会话头部出现「多工作目录」按钮，打开面板即可：
+
+| 操作 | 行为 |
+| ---- | ---- |
+| 添加目录 | 打开原生目录选择器 |
+| 移除 / 刷新 | 立即生效 |
+| 切换会话 | 面板自动切换为该会话的副工作目录 |
+| 重新打开面板 | 使用会话级缓存，不产生冗余命令行 |
+
+等价的用户斜杠命令：
+
+```
+/multi-folder list
+/multi-folder add "D:\path\to\repo"
+/multi-folder remove "D:\path\to\repo"
+/multi-folder set "D:\a" "D:\b"
+```
+
+Agent 无需任何额外操作：`read` / `glob` / `grep` 随处可用；`write` / `edit` / `pwsh` / `bash` 在路径（或 `workdir`）落入副目录时自动拦截并以该目录为沙箱根执行。
+
+## 工作原理
+
+- **拦截**——监听 `tools/execute` 环绕分派瀑布，对解析路径（或 `workdir`）落在副目录内的 `write` / `edit` / `pwsh` / `bash` 调用短路，并以**换根后的会话站立策略**（`{ ...standingPolicy, workspaceRoot: secondaryDir }`）执行。模式本身不变，因此各种沙箱模式与主工作区的语义天然一致。匹配前先经 `fs.resolve` + `processPath` 规范化，`..`、符号链接与大小写差异均正确处理。
+- **提示词注入**——一个有序 `systemPrompt` 段落，text provider 每次组装按会话求值，仅为配置了副目录的会话渲染。
+- **通知**——命令处理器仅在目录集合实际变化时置位 pending notice；`agent/pre-step`（前置注入进入批次）与 `tools/post-execute`（附加为 `additionalContexts`）两个通道中先触发者消费——均使用框架原生的插件来源 `notice` 上下文。
+- **配置与安全边界**——per-workspace 配置存储于 Agent 沙箱之外的宿主自有目录（`<DSH_HOME>/storages/multi-folder/<workspace-key>.json`）。对配置文件的任何直接 `write`/`edit` 都会收到显式拒绝——**Agent 永远无法自我授予目录，配置权仅属于用户**。详见 [SECURITY.md](SECURITY.md)。
+- **客户端**——手写维护的 factory bundle（`window.__ModuleLoader__.load`），无需构建工具链；面板经 Remote BFF（`ctx.remote.commands.execute`）驱动宿主。
+
+## 目录结构
+
+| 路径 | 作用 |
+| ---- | ---- |
+| `cordis.patch.yml` | profile patch 层，插入 `dsh-multi-folder` 行 |
+| `lib/index.js` | 宿主插件：配置存储、工具流水线拦截、提示词注入、双通道通知、`/multi-folder` 命令 |
+| `lib/client.js` | 客户端插件（factory bundle）：会话头部按钮 + 覆盖层面板 |
+| `test/` | 免 DSH 运行时的行为测试（见开发） |
+| `docs/` | 设计与分析文档 |
+
+## 开发
+
+零构建步骤：宿主半边为纯 ESM，`lib/client.js` 为 DSH client-modules 格式的手写 factory bundle。测试直接用 Node 运行：
+
+```bash
+node test/smoke-host.mjs    # 宿主 apply 冒烟
+node test/intercept.mjs     # 拦截 / 命令 / 通知行为
+node test/smoke-client.mjs  # 客户端 bundle 与面板流程（React shim）
+```
+
+修改 `lib/client.js` 前请先阅读 [docs/design.md](docs/design.md) 中的 bundle 契约。
+
+## 文档
+
+- [docs/design.md](docs/design.md) — 架构与安全模型（英文）
+- English README: [README.md](README.md)
+
+## 参与贡献
+
+见 [CONTRIBUTING.md](CONTRIBUTING.md)。欢迎提交 issue 与 PR。
+
+## 许可证
+
+[MIT](LICENSE)

package/SECURITY.md

@@ -0,0 +1,57 @@
+# Security Policy
+
+## Security model
+
+`dsh-multi-folder` widens the agent's filesystem reach **only** to directories that the
+**user explicitly configured**, and **only** within the sandbox mode the user already
+granted the session. The design enforces four boundaries:
+
+1. **User-only configuration.** Secondary directories can only be added or removed by
+   the user through the UI panel or the `/multi-folder` slash command. The agent has no
+   tool, command, or file path through which it can change the configuration.
+
+2. **Host-owned configuration store.** Per-workspace configuration lives in
+   `<DSH_HOME>/storages/multi-folder/<workspace-key>.json` — outside every agent
+   sandbox root. The agent's own tools cannot read-write there under `read-only` or
+   `workspace-write` (the sandbox fences the write path by the workspace root).
+
+3. **Explicit write guard.** `write` / `edit` calls targeting the configuration
+   file are short-circuited by the tool-pipeline interception with an explicit
+   rejection message, independent of the session mode. This turns any attempt at
+   self-escalation into a visible, explainable error instead of a silent no-op or a
+   silent success.
+
+4. **Mode parity, never escalation.** An intercepted secondary-directory operation runs
+   under the session's standing sandbox policy with only the `workspaceRoot` re-pointed
+   at the configured directory. The mode is preserved verbatim: a `read-only` session
+   is still denied in secondary directories, a `workspace-write` session gains the same
+   write/exec rights it has in its primary workspace, and only `danger-full-access`
+   bypasses confinement (as it already does for the primary workspace, by the user's
+   explicit choice).
+
+### What is deliberately out of scope
+
+- In a `danger-full-access` session the agent can already touch the whole filesystem;
+  this plugin neither adds nor removes anything there.
+- The agent can *read* the configuration file (reads are not policy-fenced in the DSH
+  filesystem backend). Reading reveals nothing the system prompt does not already list
+  for that session.
+
+## Reporting a vulnerability
+
+If you believe you have found a security issue in this plugin, please report it
+privately by opening a GitHub Security Advisory on the repository instead of a public
+issue. Please include:
+
+- the affected version,
+- a minimal reproduction,
+- the expected vs. observed behavior.
+
+We will acknowledge the report within 7 days and aim to publish a fix (or a
+documented mitigation) before public disclosure.
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 0.1.x   | ✅        |

package/cordis.patch.yml

@@ -0,0 +1,8 @@
+# dsh-multi-folder bundle patch.
+#
+# Applied as a profile patch layer after every in-box bundle. Inserts the
+# plugin row at the profile root; later layers (or the user's own
+# cordis.patch.yml) can address it by id with the last write winning.
+- insert:
+    - id: dsh-multi-folder
+      name: 'dsh-multi-folder'

package/docs/design.md

@@ -0,0 +1,133 @@
+# Design
+
+Architecture and invariants of `dsh-multi-folder`.
+
+## Goal
+
+One DSH project (workspace) gains a user-managed set of **secondary working
+directories**. The agent's core `cwd` stays the primary workspace; framework-level
+interception makes the existing tools work inside the secondary directories under the
+session's current sandbox mode; prompt injection and boundary notifications keep the
+agent informed. No new tools are added.
+
+## Planes
+
+| Half | File | Role |
+| ---- | ---- | ---- |
+| Host | `lib/index.js` | Config store, tool-pipeline interception, prompt section, notifications, `/multi-folder` command |
+| Client | `lib/client.js` | Session-header button + overlay panel; drives the host through the Remote BFF |
+
+The package declares both faces: `dsh.bundle.patch` (the host row inserted by
+`cordis.patch.yml`) and `dsh.client` (the web bundle at `exports["./client"]`).
+
+## Host: interception
+
+A listener on the `tools/execute` around-dispatch waterfall handles `write`, `edit`,
+`pwsh`, and `bash`:
+
+1. Resolve the session's standing policy via
+   `sandboxPolicy.resolve({ session: exec.agent.session })`.
+2. Canonicalize the target path (`write`/`edit`: `fs.resolve(file_path, { cwd: primary })`
+   + `fs.processPath`; `pwsh`/`bash`: the same treatment for the resolved `workdir`).
+   This makes `..`, symlinks, and case differences match correctly.
+3. **Config guard**: if the canonical path equals the host-owned config file,
+   short-circuit with an explicit rejection (see Security).
+4. If the canonical path is inside a configured secondary directory, execute the
+   operation directly with `{ ...standingPolicy, workspaceRoot: <secondary dir> }`:
+   - `write`/`edit` → `fs.writeText` / `fs.editText`;
+   - `pwsh`/`bash` → `shell.resolve({ command, workdir, dshEnv, sandboxPolicy })` +
+     `shell.run`, with the canonical workdir so the confinement root and the process
+     cwd agree exactly.
+   The result carries the same canonical value/content shapes as the shipped tools, so
+   downstream presentation keeps working.
+5. Anything else — unknown tools, paths outside every secondary directory, escalation
+   arguments (`sandbox_permissions`), `run_in_background`, missing optional services,
+   or any error — falls through to `next()` and the default pipeline.
+
+**Why mode parity is free:** the mode field of the standing policy is never touched.
+The DSH sandbox backends treat the per-call policy as fully specified and fence by its
+`workspaceRoot` + `mode`. `read-only` sessions therefore keep getting denied in
+secondary directories exactly as in the primary workspace.
+
+Reads (`read`, `glob`, `grep`) need no interception: the DSH filesystem backend does
+not policy-fence read paths.
+
+### Service resolution must be lazy
+
+Loader rows activate in dependency order, and this row deliberately declares no hard
+dependency on the shell executor or the command registry. Capturing `ctx.get('shell')`
+at apply time can yield `undefined` when the provider row activates later. Therefore:
+
+- `shell` / `shellEnv` are resolved **per call** inside the listener;
+- the `/multi-folder` command is registered through
+  `ctx.inject(['commands'], ctx => ctx.commands.register(...))`, which activates
+  whenever the service appears and is disposed with the plugin fiber.
+
+## Host: configuration store
+
+- Canonical location: `<DSH_HOME>/storages/multi-folder/<workspace-key>.json`
+  (`DSH_HOME` falls back to `~/.dsh`), i.e. **outside every agent sandbox root**.
+- Writes happen only from the command handler (user-initiated) with an explicit
+  `workspace-write` policy rooted at the config directory.
+- A per-process cache keyed by normalized workspace path hydrates lazily (on
+  `agent/created`, `agent/pre-step`, and `tools/execute`).
+
+## Host: prompt injection and notifications
+
+- One global `systemPrompt.section` (`multi-folder:secondary-dirs`, order 160) whose
+  text provider evaluates per assembly: it reads `context.agent.session.header.cwd`
+  and renders the configured directories only for sessions that have them.
+- Change notifications use the framework's plugin-sourced `notice` context:
+  - the command handler arms a pending notice **only when the directory set changed**;
+  - the next boundary consumes it — `agent/pre-step` prepends it to the entering
+    message batch, or `tools/post-execute` attaches it as `additionalContexts` —
+    whichever fires first. No turn is ever interrupted.
+
+## Client
+
+`lib/client.js` is a **hand-maintained factory bundle** in the DSH client-modules
+format — no build toolchain:
+
+```js
+window.__ModuleLoader__.load({
+  id: 'dsh-multi-folder',
+  factory: (require) => { /* CJS-style module body; exports = { name, inject, apply } */ },
+})
+```
+
+- `inject: ['remote', 'remote.commands', 'slots', 'workspaces']`; the package's
+  `dsh.client.inject` lists the packages providing them
+  (`@deepseek-ai/dsh-api-gateway`, `@deepseek-ai/dsh-api-remotes`,
+  `@deepseek-ai/dsh-client-runtime`).
+- UI registrations: `conversation.session.header.actions` (session-scoped button) and
+  `shell.overlay` (root-scoped panel). One module-level store is shared by both.
+- Host communication: `ctx.remote.commands.execute(sessionId, line)`. The return value
+  is the RPC envelope `{ ok, value }` where `value` is the `CommandExecution`; command
+  result text carries a `[MF:JSON] {…}` line the panel parses for structured state.
+- Session switch: a `React.useEffect` on `sessionId` re-points the open panel to the
+  current session, reusing the per-session cache (no command row) or refreshing.
+- Per-session caching keeps pure reads (`list`) off the conversation: the command runs
+  only on first open per session or on explicit refresh; mutations return their data
+  directly and remain visible change records (command lifecycle events are log-only
+  and never reach the model).
+
+## Known limitations
+
+- Intercepted secondary-directory writes bypass the fs observation policy: they emit
+  no `fs/observed` event and do not participate in the `fs/write-intent` intent guard.
+  This is deliberate — secondary directories sit outside the primary workspace's
+  observation domain.
+- `presentationMeta` is not computed on the short-circuit path; tool cards fall back to
+  their default presentation.
+- `run_in_background` and `sandbox_permissions` escalation on `pwsh`/`bash` calls in
+  secondary directories are passed through to the default pipeline.
+- The `/multi-folder` command lifecycle rows (`command/run`, `command/done`) are
+  visible in the conversation UI by framework design; they are log-only and never
+  reach the model.
+
+## Tests
+
+`test/smoke-host.mjs`, `test/intercept.mjs`, and `test/smoke-client.mjs` run without
+the DSH runtime using mock services and a React shim. They cover interception,
+canonicalization, the config guard, both notification channels, notice
+gating, command flows, and the panel's session-switch/caching behavior.

package/lib/client.js

@@ -0,0 +1,344 @@
+/**
+ * dsh-multi-folder — client half (hand-written factory bundle, no build step).
+ *
+ * Session-scoped UI: a "多工作目录" button in the conversation session header
+ * (`conversation.session.header.actions`, scope: session) that opens a panel in
+ * `shell.overlay` listing the project's secondary working directories.
+ * Mutations go through the Host `/multi-folder` command via the Remote BFF
+ * (`ctx.remote.commands.execute(sessionId, line)`); the Host answers with a
+ * human-readable result carrying a `[MF:JSON]` line the panel parses for
+ * structured state.
+ *
+ * Layout shape: an entry in the session header action row plus a frame-wide
+ * overlay panel. Both read one tiny module-scoped store; opening the panel
+ * refreshes the list from the Host.
+ */
+window.__ModuleLoader__.load({
+  id: 'dsh-multi-folder',
+  factory: (require) => {
+    var module = { exports: {} };
+    var exports = module.exports;
+    var React = require('react');
+
+    // ------------------------------------------------------------- store
+    var listeners = new Set();
+    var state = { open: false, sessionId: null, dirs: [], workspace: null, busy: false, error: null };
+    function patch(next) {
+      state = Object.assign({}, state, next);
+      listeners.forEach(function (fn) { fn(); });
+    }
+    function subscribe(fn) {
+      listeners.add(fn);
+      return function () { listeners.delete(fn); };
+    }
+    function getSnapshot() { return state; }
+    function useStore() { return React.useSyncExternalStore(subscribe, getSnapshot); }
+    /** sessionId -> { dirs, workspace }: avoids re-running the list command
+     *  (and its conversation row) on every panel open. */
+    var sessionCache = {};
+
+    function parseJsonLine(text) {
+      if (typeof text !== 'string') return null;
+      var m = /\[MF:JSON\]\s*(\{.*\})\s*$/s.exec(text);
+      if (!m) return null;
+      try { return JSON.parse(m[1]); } catch (_) { return null; }
+    }
+
+    // ------------------------------------------------------------- plugin
+    var name = 'dsh-multi-folder';
+    var inject = ['remote', 'remote.commands', 'slots', 'workspaces'];
+
+    function apply(ctx) {
+      var slots = ctx.slots;
+      var remote = ctx.remote;
+      var workspaces = ctx.workspaces;
+
+      function runCommand(sessionId, line) {
+        return remote.commands.execute(sessionId, line).then(function (envelope) {
+          if (!envelope || envelope.ok !== true) {
+            throw new Error('multi-folder: ' + (envelope && envelope.error !== undefined ? String(envelope.error) : 'remote call failed'));
+          }
+          var execution = envelope.value;
+          if (execution === undefined || execution === null) {
+            throw new Error('multi-folder: command did not match — is the host plugin loaded?');
+          }
+          var result = execution.result;
+          if (!result) throw new Error('multi-folder: command returned no result');
+          if (result.kind === 'error') throw new Error(result.text || 'multi-folder: command failed');
+          return result.text || '';
+        });
+      }
+
+      function refresh(sessionId) {
+        if (!sessionId) return;
+        patch({ busy: true, error: null });
+        runCommand(sessionId, '/multi-folder list').then(function (text) {
+          var parsed = parseJsonLine(text);
+          if (parsed) {
+            sessionCache[sessionId] = { workspace: parsed.workspace, dirs: parsed.dirs };
+          }
+          patch({
+            busy: false,
+            workspace: parsed ? parsed.workspace : null,
+            dirs: parsed ? parsed.dirs : [],
+          });
+        }).catch(function (e) {
+          patch({ busy: false, error: String(e && e.message ? e.message : e) });
+        });
+      }
+
+      function mutate(sessionId, line) {
+        patch({ busy: true, error: null });
+        return runCommand(sessionId, line).then(function (text) {
+          var parsed = parseJsonLine(text);
+          if (parsed) {
+            sessionCache[sessionId] = { workspace: parsed.workspace, dirs: parsed.dirs };
+            patch({
+              busy: false,
+              workspace: parsed.workspace,
+              dirs: parsed.dirs,
+            });
+          } else {
+            refresh(sessionId);
+          }
+        }).catch(function (e) {
+          patch({ busy: false, error: String(e && e.message ? e.message : e) });
+          refresh(sessionId);
+        });
+      }
+
+      function addDirectory(sessionId) {
+        workspaces.pickDirectory().then(function (path) {
+          if (path === null || path === undefined) return;
+          mutate(sessionId, '/multi-folder add "' + path.replace(/"/g, '\\"') + '"');
+        }).catch(function (e) {
+          patch({ error: String(e && e.message ? e.message : e) });
+        });
+      }
+
+      /** Open the panel for a session, reusing cached data when present so
+       *  pure reads do not produce conversation rows. */
+      function openFor(sessionId) {
+        if (!sessionId) return;
+        var cached = sessionCache[sessionId];
+        patch({
+          open: true,
+          sessionId: sessionId,
+          dirs: cached ? cached.dirs : [],
+          workspace: cached ? cached.workspace : null,
+          error: null,
+        });
+        if (cached === undefined) refresh(sessionId);
+      }
+
+      // Header button -----------------------------------------------------
+      function HeaderButton(props) {
+        var store = useStore();
+        var sessionId = props.sessionId;
+        var open = store.open && store.sessionId === sessionId;
+        // Session switch: keep the panel in sync with the session this
+        // header belongs to. On a changed sessionId (or first mount) with
+        // the panel open, switch the panel content to this session, reusing
+        // cached data (no conversation row) or refreshing from the Host.
+        React.useEffect(
+          function () {
+            var current = getSnapshot();
+            if (current.open && current.sessionId !== sessionId) {
+              openFor(sessionId);
+            }
+          },
+          [sessionId],
+        );
+        var btn = React.createElement(
+          'button',
+          {
+            type: 'button',
+            title: '多工作目录（副工作目录）',
+            onClick: function () {
+              var current = getSnapshot();
+              var isOpen = current.open && current.sessionId === sessionId;
+              if (isOpen) {
+                patch({ open: false });
+              } else {
+                openFor(sessionId);
+              }
+            },
+            style: {
+              display: 'inline-flex',
+              alignItems: 'center',
+              gap: 6,
+              padding: '4px 10px',
+              borderRadius: 8,
+              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
+              background: open ? 'var(--color-bg-accent, rgba(80,120,255,0.18))' : 'transparent',
+              color: 'var(--color-text, inherit)',
+              fontSize: 13,
+              cursor: 'pointer',
+            },
+          },
+          open ? '多工作目录 ▾' : '多工作目录',
+        );
+        return btn;
+      }
+
+      // Overlay panel ------------------------------------------------------
+      function Panel() {
+        var store = useStore();
+        if (!store.open || !store.sessionId) return null;
+        var rows = (store.dirs || []).map(function (dir, index) {
+          return React.createElement(
+            'div',
+            {
+              key: index,
+              style: {
+                display: 'flex',
+                alignItems: 'center',
+                gap: 8,
+                padding: '6px 8px',
+                borderRadius: 6,
+                background: 'var(--color-bg-subtle, rgba(127,127,127,0.08))',
+                marginBottom: 6,
+              },
+            },
+            React.createElement(
+              'div',
+              {
+                title: dir,
+                style: { flex: 1, fontSize: 13, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' },
+              },
+              dir,
+            ),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                title: '移除此副工作目录',
+                onClick: function () { mutate(store.sessionId, '/multi-folder remove "' + dir.replace(/"/g, '\\"') + '"'); },
+                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', color: 'var(--color-danger, #c62828)', cursor: 'pointer' },
+              },
+              '移除',
+            ),
+          );
+        });
+        return React.createElement(
+          'div',
+          {
+            style: {
+              position: 'fixed',
+              top: 64,
+              right: 20,
+              width: 380,
+              maxWidth: 'calc(100vw - 40px)',
+              zIndex: 400,
+              background: 'var(--color-bg-elevated, #ffffff)',
+              color: 'var(--color-text, #1a1a1a)',
+              border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
+              borderRadius: 12,
+              boxShadow: '0 8px 32px rgba(0,0,0,0.18)',
+              padding: 14,
+              fontSize: 13,
+            },
+          },
+          React.createElement(
+            'div',
+            { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 10 } },
+            React.createElement('div', { style: { fontWeight: 600, fontSize: 14 } }, '多工作目录（副工作目录）'),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                title: '关闭',
+                onClick: function () { patch({ open: false }); },
+                style: { padding: '2px 8px', borderRadius: 6, border: '1px solid transparent', background: 'transparent', cursor: 'pointer' },
+              },
+              '✕',
+            ),
+          ),
+          store.workspace
+            ? React.createElement(
+                'div',
+                { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)', fontSize: 12, wordBreak: 'break-all' } },
+                '项目：' + store.workspace,
+              )
+            : null,
+          rows.length > 0 ? rows : React.createElement('div', { style: { marginBottom: 8, color: 'var(--color-text-muted, #6b6b6b)' } }, '尚未配置副工作目录。'),
+          store.error
+            ? React.createElement('div', { style: { marginBottom: 8, color: 'var(--color-danger, #c62828)', whiteSpace: 'pre-wrap' } }, String(store.error))
+            : null,
+          React.createElement(
+            'div',
+            { style: { display: 'flex', gap: 8, marginTop: 4 } },
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: !!store.busy,
+                onClick: function () { addDirectory(store.sessionId); },
+                style: {
+                  flex: 1,
+                  padding: '6px 10px',
+                  borderRadius: 8,
+                  border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
+                  background: 'var(--color-bg-accent, rgba(80,120,255,0.14))',
+                  color: 'var(--color-text, inherit)',
+                  cursor: store.busy ? 'default' : 'pointer',
+                  opacity: store.busy ? 0.6 : 1,
+                },
+              },
+              store.busy ? '处理中…' : '+ 添加目录',
+            ),
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                disabled: !!store.busy,
+                onClick: function () { refresh(store.sessionId); },
+                style: {
+                  padding: '6px 10px',
+                  borderRadius: 8,
+                  border: '1px solid var(--color-border, rgba(127,127,127,0.35))',
+                  background: 'transparent',
+                  color: 'var(--color-text, inherit)',
+                  cursor: store.busy ? 'default' : 'pointer',
+                  opacity: store.busy ? 0.6 : 1,
+                },
+              },
+              '刷新',
+            ),
+          ),
+          React.createElement(
+            'div',
+            {
+              style: {
+                marginTop: 10,
+                fontSize: 11,
+                lineHeight: 1.5,
+                color: 'var(--color-text-muted, #6b6b6b)',
+              },
+            },
+            'Agent 的主工作目录不变；在 Workspace Write 模式下，Agent 对上述目录拥有与主工作目录同等的读写与命令执行权限。配置变更会在下一条消息或工具调用结束时通知 Agent。',
+          ),
+        );
+      }
+
+      // Registrations ------------------------------------------------------
+      slots.inject('conversation.session.header.actions', function () {
+        return slots.register(
+          { name: 'conversation.session.header.actions', id: 'multi-folder', order: 30, label: '多工作目录' },
+          function (props) { return React.createElement(HeaderButton, props); },
+        );
+      });
+      slots.inject('shell.overlay', function () {
+        return slots.register(
+          { name: 'shell.overlay', id: 'multi-folder', order: 100, label: '多工作目录' },
+          function () { return React.createElement(Panel); },
+        );
+      });
+    }
+
+    exports.name = name;
+    exports.inject = inject;
+    exports.apply = apply;
+    return module.exports;
+  },
+});

package/lib/index.js

@@ -0,0 +1,496 @@
+/**
+ * dsh-multi-folder — host half.
+ *
+ * Secondary working directories for a project, delivered as framework-level
+ * and UI-level changes only (no new tools):
+ *
+ * 1. Per-workspace config in a HOST-OWNED store outside the agent's sandbox
+ *    (`<DSH_HOME>/storages/multi-folder/<workspace-key>.json`, JSON array of
+ *    absolute secondary directory paths), cached in memory and hydrated
+ *    lazily per session. Direct write/edit attempts against the config file
+ *    are rejected with an explicit message, so the agent can NEVER
+ *    self-grant directories — configuration is user-managed by design.
+ * 2. Tool-pipeline interception (`tools/execute` around-dispatch waterfall):
+ *    `write` / `edit` / `pwsh` / `bash` calls whose path (or resolved
+ *    `workdir`) lands inside a configured secondary directory are serviced
+ *    here with the session's standing sandbox policy re-rooted to that
+ *    directory — identical semantics to the primary workspace in every mode
+ *    (read-only denies, workspace-write allows, danger-full-access allows).
+ *    Reads (read/glob/grep) are unfenced and already work.
+ * 3. Prompt injection: one ordered system-prompt section rendered per
+ *    assembly from the configured directories of the assembling session.
+ * 4. Non-interrupting change notification: configuration changes made via
+ *    the `/multi-folder` command arm a pending notice — only when the
+ *    directory set actually changed — delivered at the NEXT message
+ *    boundary: the next `agent/pre-step` (user send) or the next
+ *    `tools/post-execute` (tool-call end), through the framework's native
+ *    plugin-sourced `notice` context channel.
+ * 5. `/multi-folder` command (list/add/remove/set): the human-command
+ *    registry entry the browser UI drives through the Remote BFF.
+ */
+
+import { join } from 'node:path'
+import os from 'node:os'
+
+export const name = 'dsh-multi-folder'
+export const inject = ['fs', 'sandboxPolicy', 'systemPrompt']
+
+/** Host-owned store, outside every agent sandbox root. */
+const configDir = () => join(process.env.DSH_HOME || join(os.homedir(), '.dsh'), 'storages', 'multi-folder')
+const configFileName = (ws) => String(ws).replace(/[^a-z0-9]+/gi, '-').toLowerCase() + '.json'
+const configPathFor = (ws) => join(configDir(), configFileName(ws))
+const SECTION_NAME = 'multi-folder:secondary-dirs'
+/** Tool guidance sections use orders 100–129; sit clearly after them. */
+const SECTION_ORDER = 160
+const COMMAND_NAME = 'multi-folder'
+const INTERCEPT_TOOLS = new Set(['write', 'edit', 'pwsh', 'bash'])
+/** Marker line the browser UI parses out of command results. */
+const JSON_MARK = '[MF:JSON]'
+const CONFIG_GUARD_TEXT =
+  'This file is managed by the dsh-multi-folder plugin. Secondary working directories may only be ' +
+  'configured by the user through the UI panel or the /multi-folder command; direct edits are rejected.'
+
+export function apply(ctx) {
+  const { fs, sandboxPolicy, systemPrompt } = ctx
+  // NOTE: shell, shellEnv, and commands are deliberately NOT captured here.
+  // Loader rows activate in dependency order, and this row declares no hard
+  // dependency on those services — capturing them at apply time can yield
+  // `undefined` when their provider rows activate later. The shell executor
+  // is resolved per call below, and the command is registered through
+  // ctx.inject so it activates whenever the commands service appears.
+
+  let noteSeq = 0
+  /** wsKey(primary) -> { dirs: string[] } */
+  const dirsCache = new Map()
+  /** String(sessionId) -> notice text awaiting the next message boundary. */
+  const pendingNotices = new Map()
+
+  // ---------------------------------------------------------------- helpers
+  const wsKey = (p) => String(p).replace(/\\/g, '/').toLowerCase().replace(/\/+$/, '')
+  const isAbsolute = (p) => /^[A-Za-z]:[\\/]/.test(p) || p.startsWith('/') || p.startsWith('\\\\')
+  const pathInside = (p, root) => {
+    const P = wsKey(p)
+    const R = wsKey(root)
+    return P === R || P.startsWith(R + '/')
+  }
+  const displayPathOf = (target, fallback) =>
+    target.displayPath !== undefined && target.displayPath !== null ? String(target.displayPath) : fallback
+  const longestRootFirst = (dirs) => [...dirs].sort((a, b) => b.length - a.length)
+
+  // ----------------------------------------------------------- config store
+  function sanitizeDirs(list, ws) {
+    const out = []
+    const seen = new Set()
+    for (const item of list) {
+      if (typeof item !== 'string' || item.trim().length === 0) continue
+      const abs = item.trim()
+      if (!isAbsolute(abs)) continue
+      if (wsKey(abs) === wsKey(ws)) continue // never the primary workspace itself
+      const key = wsKey(abs)
+      if (seen.has(key)) continue
+      seen.add(key)
+      out.push(abs)
+    }
+    return out
+  }
+
+  /** Canonical absolute path for a user-supplied directory (handles `..`, symlinks). */
+  async function canonicalizeAbs(path) {
+    try {
+      const target = await fs.resolve(path.trim())
+      return fs.processPath(target)
+    } catch {
+      return null
+    }
+  }
+
+  async function loadDirs(ws) {
+    if (typeof ws !== 'string' || ws.length === 0) return { dirs: [] }
+    const key = wsKey(ws)
+    const cached = dirsCache.get(key)
+    if (cached !== undefined) return cached
+    const fresh = { dirs: [] }
+    try {
+      const target = await fs.resolve(configPathFor(ws))
+      const raw = await fs.readText(target)
+      const parsed = JSON.parse(raw)
+      if (Array.isArray(parsed)) fresh.dirs = sanitizeDirs(parsed, ws)
+    } catch {
+      // absent or unreadable config -> empty list
+    }
+    dirsCache.set(key, fresh)
+    return fresh
+  }
+
+  function hydrate(ws) {
+    if (typeof ws === 'string' && ws.length > 0) void loadDirs(ws)
+  }
+
+  async function saveDirs(ws, dirs) {
+    const content = JSON.stringify(dirs, null, 2) + '\n'
+    const target = await fs.resolve(configPathFor(ws))
+    // Config writes are user-initiated (via the UI command); the store lives
+    // outside every agent sandbox root, so the explicit policy is rooted at
+    // the host-owned config directory itself.
+    await fs.writeText(target, content, undefined, undefined, {
+      mode: 'workspace-write',
+      workspaceRoot: configDir(),
+    })
+  }
+
+  function dirsForSync(ws) {
+    if (typeof ws !== 'string' || ws.length === 0) return null
+    const entry = dirsCache.get(wsKey(ws))
+    if (entry === undefined || entry.dirs.length === 0) return null
+    return entry.dirs
+  }
+
+  function dirsText(ws, dirs) {
+    if (dirs.length === 0) return 'No secondary working directories configured for ' + ws + '.'
+    return 'Secondary working directories for ' + ws + ':\n' + dirs.map((d) => '- ' + d).join('\n')
+  }
+
+  // -------------------------------------------------------- notice channel
+  const noticeMessage = (text) => ({
+    id: 'mf-note-' + (++noteSeq),
+    role: 'user',
+    content: [{ type: 'text', text }],
+    source: {
+      kind: 'plugin',
+      plugin: name,
+      form: 'notice',
+      summary: String(text).split('\n')[0].slice(0, 120),
+    },
+  })
+
+  const armNotice = (agent, text) => {
+    if (!agent || !agent.session) return
+    pendingNotices.set(String(agent.session.id), text)
+  }
+
+  const takeNotice = (agent) => {
+    if (!agent || !agent.session) return undefined
+    const key = String(agent.session.id)
+    const text = pendingNotices.get(key)
+    if (text !== undefined) pendingNotices.delete(key)
+    return text
+  }
+
+  // ------------------------------------------------------ prompt injection
+  systemPrompt.section({
+    name: SECTION_NAME,
+    order: SECTION_ORDER,
+    text: (context) => {
+      const ws =
+        context.agent && context.agent.session && context.agent.session.header
+          ? context.agent.session.header.cwd
+          : undefined
+      if (typeof ws !== 'string' || ws.length === 0) return ''
+      const dirs = dirsForSync(ws)
+      if (dirs === null) return ''
+      return (
+        'Secondary working directories are available in this session (dsh-multi-folder plugin):\n' +
+        dirs.map((d) => '- ' + d).join('\n') +
+        '\nYou have the SAME read/write/edit and command-execution permissions on these directories as on the primary workspace under the current sandbox mode. ' +
+        'Use absolute paths inside them (or pass `workdir` to shell tools). The primary workspace remains the default working directory.'
+      )
+    },
+  })
+
+  // ----------------------------------------------- notification (pre-step)
+  ctx.on('agent/pre-step', async (payload, next) => {
+    if (payload.agent && payload.agent.session && payload.agent.session.header) {
+      hydrate(payload.agent.session.header.cwd)
+    }
+    const decision = await next()
+    if (decision.kind !== 'enter') return decision
+    const text = takeNotice(payload.agent)
+    if (text === undefined) return decision
+    return { kind: 'enter', messages: [noticeMessage(text), ...decision.messages] }
+  })
+
+  // --------------------------------------- notification (tool-call boundary)
+  ctx.on('tools/post-execute', async (exec, result, next) => {
+    const decision = await next()
+    const text = takeNotice(exec.agent)
+    if (text === undefined) return decision
+    const msg = noticeMessage(text)
+    if (decision.kind === 'block') {
+      return {
+        kind: 'block',
+        feedback: decision.feedback,
+        additionalContexts: [msg, ...(decision.additionalContexts || [])],
+      }
+    }
+    return { ...decision, additionalContexts: [msg, ...(decision.additionalContexts || [])] }
+  })
+
+  // ------------------------------------------------- tool-pipeline intercept
+  const shellRender = (value) => {
+    let text = value.stdout && typeof value.stdout.text === 'string' ? value.stdout.text : ''
+    if (value.stderr && typeof value.stderr.text === 'string' && value.stderr.text.length > 0) {
+      text += text.endsWith('\n') ? '' : '\n'
+      text += value.stderr.text
+    }
+    if (value.exitCode !== 0) {
+      text += text.endsWith('\n') ? '' : '\n'
+      text += '[exit code: ' + value.exitCode + ']'
+    }
+    if (value.sandbox && value.sandbox.denied) {
+      text += '\n[sandbox: file access denied under ' + value.sandbox.mode + ' mode]'
+    }
+    return text
+  }
+
+  ctx.on('tools/execute', async (exec, next) => {
+    if (exec.agent && exec.agent.session && exec.agent.session.header) {
+      hydrate(exec.agent.session.header.cwd)
+    }
+    if (!INTERCEPT_TOOLS.has(exec.name)) return next()
+    try {
+      const args = exec.arguments
+      const standing = sandboxPolicy.resolve(exec.agent ? { session: exec.agent.session } : {})
+      const primary = standing.workspaceRoot
+      // An explicit escalation request belongs to the default pipeline.
+      if (args && args.sandbox_permissions !== undefined) return next()
+
+      if (exec.name === 'write' || exec.name === 'edit') {
+        const filePath = args && typeof args.file_path === 'string' ? args.file_path : null
+        if (filePath === null) return next()
+        // Resolve first so `..`, symlinks, and case differences canonicalize
+        // before containment matching (same cwd the shipped tools use).
+        const target = await fs.resolve(filePath, { cwd: primary })
+        const abs = fs.processPath(target)
+        // Security boundary: configuration is user-managed. Reject direct
+        // write/edit attempts against the host-owned config file, even before
+        // any directory matching.
+        if (wsKey(abs) === wsKey(configPathFor(primary))) {
+          return {
+            isError: true,
+            error: { message: 'multi-folder configuration is user-managed' },
+            content: [{ type: 'text', text: CONFIG_GUARD_TEXT }],
+          }
+        }
+        const dirs = dirsForSync(primary)
+        if (dirs === null) return next()
+        const hit = longestRootFirst(dirs).find((d) => pathInside(abs, d))
+        if (hit === undefined) return next()
+        const policy = { ...standing, workspaceRoot: hit }
+
+        if (exec.name === 'write') {
+          const outcome = await fs.writeText(target, String(args.content), undefined, exec.signal, policy)
+          const displayPath = displayPathOf(target, filePath)
+          const value = {
+            path: displayPath,
+            operation: outcome.operation === 'create' ? 'create' : 'update',
+            before: outcome.before === undefined || outcome.before === null ? null : outcome.before,
+            after: outcome.after === undefined ? null : outcome.after,
+          }
+          const content = [{
+            type: 'text',
+            text:
+              '<path>' + displayPath + '</path>\n<type>file</type>\n<content>\n' +
+              (outcome.operation === 'create' ? 'Created' : 'Updated') +
+              ' file\n</content>',
+          }]
+          return { isError: false, value, content }
+        }
+
+        const oldString = args && typeof args.old_string === 'string' ? args.old_string : null
+        const newString = args && typeof args.new_string === 'string' ? args.new_string : null
+        if (oldString === null || newString === null) return next()
+        const replaceAll = args.replace_all === true
+        const outcome = await fs.editText(
+          target,
+          { oldString, newString, replaceAll },
+          undefined,
+          exec.signal,
+          policy,
+        )
+        const displayPath = displayPathOf(target, filePath)
+        const value = { path: displayPath, before: outcome.before, after: outcome.after }
+        const text = replaceAll
+          ? 'The file ' + displayPath + ' has been updated. All occurrences were successfully replaced.'
+          : 'The file ' + displayPath + ' has been updated successfully.'
+        return { isError: false, value, content: [{ type: 'text', text }] }
+      }
+
+      if (exec.name === 'pwsh' || exec.name === 'bash') {
+        const shell = ctx.get('shell')
+        if (shell === undefined) return next()
+        if (args && args.run_in_background === true) return next()
+        const dirs = dirsForSync(primary)
+        if (dirs === null) return next()
+        const rawWorkdir = args && typeof args.workdir === 'string' ? args.workdir : null
+        const joined = rawWorkdir === null
+          ? String(primary)
+          : isAbsolute(rawWorkdir)
+            ? rawWorkdir
+            : String(primary).replace(/[\\/]+$/, '') + '/' + rawWorkdir
+        // Canonicalize before containment matching, then run in the canonical
+        // directory so confinement root and process cwd agree exactly.
+        const workdirTarget = await fs.resolve(joined, { cwd: primary })
+        const absWorkdir = fs.processPath(workdirTarget)
+        const hit = longestRootFirst(dirs).find((d) => pathInside(absWorkdir, d))
+        if (hit === undefined) return next()
+        const policy = { ...standing, workspaceRoot: hit }
+        const shellEnv = ctx.get('shellEnv')
+        const request = {
+          command: String(args.command),
+          workdir: absWorkdir,
+          ...(args && args.timeoutMs !== undefined ? { timeoutMs: args.timeoutMs } : {}),
+          ...(shellEnv !== undefined ? { dshEnv: shellEnv.collect(exec) } : {}),
+          sandboxPolicy: policy,
+        }
+        const result = await shell.run(shell.resolve({ ...request, signal: exec.signal }))
+        if (result.aborted) {
+          return {
+            isError: true,
+            error: { message: 'tool call aborted' },
+            content: [{ type: 'text', text: '[aborted]' }],
+          }
+        }
+        const stream = (s) => ({
+          text: s && typeof s.text === 'string' ? s.text : '',
+          truncated: !!(s && s.truncated),
+          ...(s && s.spillPath !== undefined ? { spillPath: s.spillPath } : {}),
+        })
+        const value = {
+          kind: 'foreground',
+          exitCode: result.exitCode === undefined ? null : result.exitCode,
+          signal: result.signal === undefined ? null : result.signal,
+          timedOut: !!result.timedOut,
+          aborted: false,
+          timeoutMs: result.timeoutMs === undefined ? null : result.timeoutMs,
+          stdout: stream(result.stdout),
+          stderr: stream(result.stderr),
+          ...(result.sandbox !== undefined
+            ? {
+                sandbox: {
+                  mode: String(result.sandbox.mode),
+                  denied: !!result.sandbox.denied,
+                  ...(result.sandbox.enforcement !== undefined
+                    ? { enforcement: String(result.sandbox.enforcement) }
+                    : {}),
+                  ...(result.sandbox.runnerFailed !== undefined
+                    ? { runnerFailed: !!result.sandbox.runnerFailed }
+                    : {}),
+                },
+              }
+            : {}),
+        }
+        return { isError: false, value, content: [{ type: 'text', text: shellRender(value) }] }
+      }
+      return next()
+    } catch {
+      // Any interception failure falls back to the default pipeline.
+      return next()
+    }
+  })
+
+  // ---------------------------------------------------- hydration on start
+  ctx.on('agent/created', (payload) => {
+    const agent = payload && payload.agent
+    if (agent && agent.session && agent.session.header) hydrate(agent.session.header.cwd)
+  })
+
+  // ------------------------------------------------------ /multi-folder cmd
+  ctx.inject(['commands'], (c) => {
+    const commands = c.commands
+    const parseArgs = (raw) => {
+      const out = []
+      let cur = ''
+      let inQuote = false
+      for (const ch of String(raw)) {
+        if (ch === '"') {
+          inQuote = !inQuote
+        } else if (!inQuote && (ch === ' ' || ch === '\t')) {
+          if (cur.length > 0) {
+            out.push(cur)
+            cur = ''
+          }
+        } else {
+          cur += ch
+        }
+      }
+      if (cur.length > 0) out.push(cur)
+      return out
+    }
+
+    const jsonLine = (obj) => JSON_MARK + ' ' + JSON.stringify(obj)
+    const resultText = (ws, dirs, changed) =>
+      dirsText(ws, dirs) + '\n' + jsonLine({ workspace: ws, dirs, changed })
+
+    return commands.register({
+      name: COMMAND_NAME,
+      description:
+        'Manage secondary working directories for this project (list / add <path> / remove <path> / set <paths...>). The agent gains workspace-write-equivalent access to these directories.',
+      input: { hint: '[list|add <path>|remove <path>|set <paths...>]' },
+      async handler(invocation) {
+        try {
+          const ws =
+            invocation.agent && invocation.agent.session && invocation.agent.session.header
+              ? String(invocation.agent.session.header.cwd)
+              : undefined
+          if (typeof ws !== 'string' || ws.length === 0) {
+            return { kind: 'error', text: 'multi-folder: session workspace is unknown' }
+          }
+          const entry = await loadDirs(ws)
+          const argv = parseArgs(invocation.rawInput)
+          const sub = argv.length === 0 ? 'list' : argv[0].toLowerCase()
+          let next
+          let changed = false
+          if (sub === 'list') {
+            return { kind: 'success', text: resultText(ws, entry.dirs, false) }
+          }
+          if (sub === 'add') {
+            const path = argv.slice(1).join(' ')
+            if (path.length === 0) return { kind: 'error', text: 'multi-folder: add requires a path' }
+            if (!isAbsolute(path)) return { kind: 'error', text: 'multi-folder: add requires an absolute path' }
+            const canonical = await canonicalizeAbs(path)
+            if (canonical === null) {
+              return { kind: 'error', text: 'multi-folder: cannot resolve path "' + path + '"' }
+            }
+            next = sanitizeDirs([...entry.dirs, canonical], ws)
+            changed = next.length !== entry.dirs.length
+          } else if (sub === 'remove') {
+            const path = argv.slice(1).join(' ')
+            if (path.length === 0) return { kind: 'error', text: 'multi-folder: remove requires a path' }
+            const canonical = await canonicalizeAbs(path)
+            const key = wsKey(canonical === null ? path : canonical)
+            next = entry.dirs.filter((d) => wsKey(d) !== key)
+            changed = next.length !== entry.dirs.length
+          } else if (sub === 'set') {
+            const canon = []
+            for (const p of argv.slice(1)) {
+              if (!isAbsolute(p)) return { kind: 'error', text: 'multi-folder: set requires absolute paths' }
+              const c = await canonicalizeAbs(p)
+              if (c === null) {
+                return { kind: 'error', text: 'multi-folder: cannot resolve path "' + p + '"' }
+              }
+              canon.push(c)
+            }
+            next = sanitizeDirs(canon, ws)
+            changed = JSON.stringify(next) !== JSON.stringify(entry.dirs)
+          } else {
+            return {
+              kind: 'error',
+              text: 'multi-folder: unknown subcommand "' + sub + '" (use list / add / remove / set)',
+            }
+          }
+          entry.dirs = next
+          if (changed) {
+            await saveDirs(ws, next)
+            armNotice(
+              invocation.agent,
+              'Secondary working directories changed (dsh-multi-folder):\n' + dirsText(ws, next),
+            )
+          }
+          return { kind: 'success', text: resultText(ws, next, changed) }
+        } catch (e) {
+          return { kind: 'error', text: 'multi-folder: ' + String(e) }
+        }
+      },
+    })
+  })
+}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "dsh-multi-folder",
+  "version": "0.1.0",
+  "description": "DeepSeek Harness plugin: secondary working directories for a project. The agent keeps the primary workspace as cwd, gains equal write/exec permissions on configured secondary directories under workspace-write mode, and is notified of configuration changes at the next message boundary.",
+  "keywords": [
+    "dsh-plugin",
+    "dsh",
+    "deepseek-harness",
+    "multi-folder",
+    "secondary-workspace",
+    "workspace"
+  ],
+  "license": "MIT",
+  "author": "Yutong Zou <yutong.zou.24@alumni.ucl.ac.uk> (https://github.com/AngelosZou)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AngelosZou/dsh-multi-folder.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AngelosZou/dsh-multi-folder/issues"
+  },
+  "homepage": "https://github.com/AngelosZou/dsh-multi-folder#readme",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": {
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "SECURITY.md",
+    "docs"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-api-gateway",
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-runtime"
+      ]
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1"
+  }
+}