dsh-multi-folder 0.1.2 → 0.1.3

package/README.md

@@ -6,6 +6,9 @@
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Node.js >= 20](https://img.shields.io/badge/Node.js-%3E%3D20-brightgreen)](https://nodejs.org/)
+[![npm version](https://img.shields.io/npm/v/dsh-multi-folder)](https://www.npmjs.com/package/dsh-multi-folder)
+[![GitHub issues](https://img.shields.io/github/issues/AngelosZou/dsh-multi-folder)](https://github.com/AngelosZou/dsh-multi-folder/issues)
+[![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin bundle that gives one project (workspace) a set of **secondary working directories**:
 
@@ -13,8 +16,7 @@ A [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugin bun
 - Under **Workspace Write** mode the agent gains the **same read / write / edit / execute permissions** on the configured secondary directories as on the primary workspace — enforced by re-rooting the session's own sandbox policy, so every mode keeps its semantics (`read-only` still denies, `workspace-write` allows, `danger-full-access` allows).
 - The directory list is **injected into the system prompt** and re-rendered per session assembly.
 - Configuration changes notify the agent through a **non-interrupting message queue** — delivered at the next message boundary (user send or tool-call end), and **only when the directory set actually changed**.
-- Configurable **before the session starts**: the session-creation page (new-session screen) offers a Multi-folder entry (「多工作目录」 in the Chinese UI) that reads and edits the same per-workspace configuration through a **sessionless remote API** (`multiFolder/*` endpoints) — no session id required.
-- **Localized UI.** The button, panel, and creation-page entries follow the DSH locale (the browser language or the Language setting in Settings): "Multi-folder" in English, 「多工作目录」 in Chinese.
+- Configurable **before the session starts**: the session-creation page (new-session screen) offers a Multi-folder entry that reads and edits the same per-workspace configuration through a **sessionless remote API** (`multiFolder/*` endpoints) — no session id required.
 - **No new tools.** Everything is a framework-level change (tool-pipeline interception) plus a UI-level change (a session-scoped header entry).
 
 ## Requirements
@@ -34,7 +36,7 @@ Then **restart the DSH backend** (host composition loads at process start) and *
 
 ## Usage
 
-A Multi-folder button (「多工作目录」 in the Chinese UI) appears in the session header, and a second entry appears on the **session-creation page** (fixed launcher in the bottom-right corner while the new-session screen is shown; an inline chip beside the workspace picker once the upstream `conversation.hero.workspaceExtras` slot is available). The panel lets you:
+A Multi-folder button appears in the session header, and a second entry appears on the **session-creation page** (fixed launcher in the bottom-right corner while the new-session screen is shown; an inline chip beside the workspace picker once the upstream `conversation.hero.workspaceExtras` slot is available). The panel lets you:
 
 | Action | Behavior |
 | ------ | -------- |

package/README.zh.md

@@ -6,6 +6,9 @@
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Node.js >= 20](https://img.shields.io/badge/Node.js-%3E%3D20-brightgreen)](https://nodejs.org/)
+[![npm version](https://img.shields.io/npm/v/dsh-multi-folder)](https://www.npmjs.com/package/dsh-multi-folder)
+[![GitHub issues](https://img.shields.io/github/issues/AngelosZou/dsh-multi-folder)](https://github.com/AngelosZou/dsh-multi-folder/issues)
+[![Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 
 一个 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件 bundle，为一个 Project（工作区）提供一组**副工作目录**：
 
@@ -14,7 +17,6 @@
 - 目录列表**注入系统提示词**，每次组装按会话求值；
 - 配置变更通过**不打断的消息队列**通知 Agent——在下一次消息边界（用户发送或工具调用结束）送达，且**仅在目录集合实际变化时**发送；
 - **会话开始前即可配置**：会话创建页（新会话界面）提供「多工作目录」入口（英文界面显示 "Multi-folder"），通过**无会话远程 API**（`multiFolder/*` 端点）读写同一份 per-workspace 配置——无需 session id；
-- **界面本地化**：按钮、面板与创建页入口跟随 DSH 的语言设置（浏览器语言或设置中的 Language 选项）：英文界面显示 "Multi-folder"，中文界面显示「多工作目录」。
 - **不新增任何工具**：改动全部位于框架级（工具流水线拦截）与 UI 级（会话级头部入口）。
 
 ## 环境要求

package/docs/design.md

@@ -35,13 +35,19 @@ A listener on the `tools/execute` around-dispatch waterfall handles `write`, `ed
 4. If the canonical path is inside a configured secondary directory, execute the
    operation directly with `{ ...standingPolicy, workspaceRoot: <secondary dir> }`:
    - `write`/`edit` → `fs.writeText` / `fs.editText`;
-   - `pwsh`/`bash` → `shell.resolve({ command, workdir, dshEnv, sandboxPolicy })` +
-     `shell.run`, with the canonical workdir so the confinement root and the process
-     cwd agree exactly.
+   - `pwsh`/`bash`, foreground → `shell.resolve({ command, workdir, dshEnv,
+     sandboxPolicy })` + `shell.run`, with the canonical workdir so the confinement
+     root and the process cwd agree exactly;
+   - `pwsh`/`bash`, background (`run_in_background: true`) → the same re-rooted
+     request registered through the generic jobs runtime (`ctx.jobs`) exactly like
+     the shipped shell tools (`kind` = tool name, `owner` = calling agent, streamed
+     reads shaped for `job_output` with sandbox markers, terminal outcome in the
+     `completed`/`killed` vocabulary). A caller-aborted call falls through to the
+     default pipeline, which raises the canonical abort error.
    The result carries the same canonical value/content shapes as the shipped tools, so
    downstream presentation keeps working.
 5. Anything else — unknown tools, paths outside every secondary directory, escalation
-   arguments (`sandbox_permissions`), `run_in_background`, missing optional services,
+   arguments (`sandbox_permissions`), missing optional services (`shell`, `jobs`),
    or any error — falls through to `next()` and the default pipeline.
 
 **Why mode parity is free:** the mode field of the standing policy is never touched.
@@ -206,8 +212,17 @@ window.__ModuleLoader__.load({
   observation domain.
 - `presentationMeta` is not computed on the short-circuit path; tool cards fall back to
   their default presentation.
-- `run_in_background` and `sandbox_permissions` escalation on `pwsh`/`bash` calls in
-  secondary directories are passed through to the default pipeline.
+- `sandbox_permissions` escalation on `pwsh`/`bash` calls in secondary directories is
+  passed through to the default pipeline, which re-roots the escalated run at the
+  PRIMARY workspace — escalation never widens a secondary root. (Background runs are
+  NOT passed through: they register with `ctx.jobs` under the same re-rooted policy
+  as foreground runs.)
+- The interceptor registers a background `pwsh`/`bash` job whenever `ctx.jobs` is
+  available; it cannot read the shipped shell tools' per-tool
+  `enableRunInBackground: false` config, so a deployment that disables background
+  execution would still serve secondary-dir background jobs. Deployments that
+  disable background execution should also disable this plugin's shell interception
+  or accept that exception.
 - The `/multi-folder` command lifecycle rows (`command/run`, `command/done`) are
   visible in the conversation UI by framework design; they are log-only and never
   reach the model. Workspace-mode (session-creation page) operations avoid them

package/lib/index.js

@@ -16,7 +16,11 @@
  *    here with the session's standing sandbox policy re-rooted to that
  *    directory — identical semantics to the primary workspace in every mode
  *    (read-only denies, workspace-write allows, danger-full-access allows).
- *    Reads (read/glob/grep) are unfenced and already work.
+ *    Background shell runs (`run_in_background: true`) register with the
+ *    generic jobs runtime (`ctx.jobs`) under the same re-rooted policy,
+ *    mirroring the shipped pwsh/bash tools so `job_output` / `job_kill` and
+ *    finish notices keep working. Reads (read/glob/grep) are unfenced and
+ *    already work.
  * 3. Prompt injection: one ordered system-prompt section rendered per
  *    assembly from the configured directories of the assembling session.
  * 4. Non-interrupting change notification: configuration changes made via
@@ -333,7 +337,8 @@ export function apply(ctx) {
         'Secondary working directories are available in this session (dsh-multi-folder plugin):\n' +
         dirs.map((d) => '- ' + d).join('\n') +
         '\nYou have the SAME read/write/edit and command-execution permissions on these directories as on the primary workspace under the current sandbox mode. ' +
-        'Use absolute paths inside them (or pass `workdir` to shell tools). The primary workspace remains the default working directory.'
+        'For shell tools, pass `workdir` pointing inside one of these directories — foreground and background (`run_in_background`) runs alike. ' +
+        'Reads from these directories work without `workdir`. The primary workspace remains the default working directory.'
       )
     },
   })
@@ -383,6 +388,49 @@ export function apply(ctx) {
     return text
   }
 
+  /** Terminal outcome for a background process, in the jobs-registry vocabulary. */
+  const processOutcome = (proc) => {
+    if (proc.status === 'killed') {
+      return {
+        status: 'killed',
+        detail: proc.signal !== null && proc.signal !== undefined ? 'signal: ' + proc.signal : 'killed before exit',
+      }
+    }
+    return {
+      status: 'completed',
+      detail: 'exit code: ' + (proc.exitCode === undefined || proc.exitCode === null ? 0 : proc.exitCode),
+    }
+  }
+
+  /**
+   * One consuming background read, shaped for `job_output`: the raw delta plus
+   * loss/spill notices and sandbox markers, mirroring the shipped pwsh/bash
+   * tools' background rendering. No escalation hint is appended — escalation
+   * calls stay on the default pipeline, which re-roots at the primary
+   * workspace, so this job can never receive a wider policy.
+   */
+  const renderProcessRead = (read, sandbox) => {
+    const notices = []
+    if (read.lossy) {
+      const paths = [read.stdoutSpillPath, read.stderrSpillPath].filter((path) => path !== undefined)
+      notices.push(
+        '[some output was dropped from memory; full output: ' +
+          (paths.length > 0 ? paths.join(', ') : '(unavailable)') +
+          ']',
+      )
+    }
+    if (sandbox && sandbox.runnerFailed) {
+      notices.push(
+        '[sandbox: the sandbox runner itself failed under ' + sandbox.mode +
+          ' mode — the command did not run; this is a sandbox problem, not a command failure]',
+      )
+    } else if (sandbox && sandbox.denied) {
+      notices.push('[sandbox: file access denied under ' + sandbox.mode + ' mode]')
+    }
+    if (notices.length === 0) return read.delta
+    return read.delta + (read.delta.length > 0 && !read.delta.endsWith('\n') ? '\n' : '') + notices.join('\n')
+  }
+
   ctx.on('tools/execute', async (exec, next) => {
     if (exec.agent && exec.agent.session && exec.agent.session.header) {
       hydrate(exec.agent.session.header.cwd)
@@ -459,7 +507,6 @@ export function apply(ctx) {
       if (exec.name === 'pwsh' || exec.name === 'bash') {
         const shell = ctx.get('shell')
         if (shell === undefined) return next()
-        if (args && args.run_in_background === true) return next()
         const dirs = dirsForSync(primary)
         if (dirs === null) return next()
         const rawWorkdir = args && typeof args.workdir === 'string' ? args.workdir : null
@@ -483,6 +530,39 @@ export function apply(ctx) {
           ...(shellEnv !== undefined ? { dshEnv: shellEnv.collect(exec) } : {}),
           sandboxPolicy: policy,
         }
+
+        // Background runs get the SAME re-rooted policy as foreground runs.
+        // They register with the generic jobs runtime (`ctx.jobs`) exactly
+        // like the shipped pwsh/bash tools do, so `job_output` / `job_kill`
+        // and the finish notice keep working for the intercepted job. A
+        // background process outlives the tool call, so no caller signal is
+        // forwarded; `shell.start` ignores `timeoutMs` by design.
+        if (args && args.run_in_background === true) {
+          // An aborted call belongs to the default pipeline, which raises the
+          // canonical abort error before anything starts.
+          if (exec.signal && exec.signal.aborted) return next()
+          const jobs = ctx.get('jobs')
+          if (jobs === undefined) return next()
+          const jobId = jobs.start({
+            kind: exec.name,
+            label: String(args.command),
+            ...(exec.agent ? { owner: exec.agent } : {}),
+            run: () => {
+              const proc = shell.start(shell.resolve(request))
+              return {
+                cancel: () => void proc.kill(),
+                done: proc.done.then(() => processOutcome(proc)),
+                readOutput: () => renderProcessRead(proc.readOutput(), proc.sandbox),
+              }
+            },
+          })
+          return {
+            isError: false,
+            value: { kind: 'background', jobId },
+            content: [{ type: 'text', text: 'started background job ' + jobId }],
+          }
+        }
+
         const result = await shell.run(shell.resolve({ ...request, signal: exec.signal }))
         if (result.aborted) {
           return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-folder",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "DeepSeek Harness plugin: secondary working directories for a project. The agent keeps the primary workspace as cwd, gains equal write/exec permissions on configured secondary directories under workspace-write mode, and is notified of configuration changes at the next message boundary. Configurable from the session header AND from the session-creation page (before the first message) through a sessionless multiFolder remote API.",
   "keywords": [
     "dsh-plugin",