dsh-multi-folder 0.2.0 → 0.2.2

package/docs/design.md

@@ -77,7 +77,17 @@ at apply time can yield `undefined` when the provider row activates later. There
   handler and the `multiFolder/*` remote endpoints) with an explicit
   `workspace-write` policy rooted at the config directory.
 - A per-process cache keyed by normalized workspace path hydrates lazily (on
-  `agent/created`, `agent/pre-step`, and `tools/execute`).
+  `agent/created`, `agent/pre-step`, and `tools/execute`). On the interception
+  path hydration is **awaited**, not fire-and-forget: a first call that landed
+  before the config read resolved would otherwise see an empty cache, fall
+  through to the default pipeline, and be fenced against the PRIMARY workspace
+  root — a spurious `[sandbox: file access denied under workspace-write mode]`
+  for a secondary-directory mutation. `loadDirs` caches, so only the first call
+  pays the read. Because `sandbox-policy` realpath-canonicalizes the policy
+  workspace root while hydration is keyed by the session cwd **as spelled in
+  the header**, a workspace reached through a symlinked/junctioned ancestor can
+  spell the two differently; the interception consults BOTH keys (and the
+  config guard checks both config-path spellings) before falling through.
 - One shared **core** (`coreList` / `coreAdd` / `coreRemove` / `coreSet`)
   implements validation, canonicalization, sanitization, cache write-through,
   and persistence. The command channel and the remote channel both call it, so
@@ -200,9 +210,13 @@ window.__ModuleLoader__.load({
     renders directly ABOVE the composer card, in the same band as the
     git-branch chip. The entry receives the dock owner share (`{ session,
     input }`) plus the standard `useSessions` / `useWorkspaces` selector hooks,
-    so the hero phase (`composerPhase === 'blank' && (openState === 'open' ||
-    blank)`) and the target workspace come from framework props instead of DOM
-    probing. The row stays **in flow** — `display:flex` with the official hero
+    so the hero phase and the target workspace come from framework props instead
+    of DOM probing. Detection is DSH-version-adaptive: a shell whose
+    `SessionSnapshot` carries `composerPhase` uses
+    `composerPhase === 'blank' && (openState === 'open' || blank)`, while DSH
+    0.1.2 (no `composerPhase`) uses the settled-blank fallback
+    `blank && !running && !promptAttempted && (openState === 'open' || blank)`.
+    The row stays **in flow** — `display:flex` with the official hero
     row's 20px indent, no absolute positioning — so the framework's list-slot
     arrangement keeps it clear of every other plugin's dock row. It renders
     only on the session-creation page; an active session keeps its entry in the
@@ -255,10 +269,12 @@ window.__ModuleLoader__.load({
   Lifting this to real multi-root confinement needs an upstream change
   (`SandboxExecutionPolicy` carrying extra write roots and the ACL runner
   accepting several workspace write SIDs).
-- Intercepted secondary-directory writes bypass the fs observation policy: they emit
-  no `fs/observed` event and do not participate in the `fs/write-intent` intent guard.
-  This is deliberate — secondary directories sit outside the primary workspace's
-  observation domain.
+- Intercepted secondary-directory mutations do not participate in the
+  `fs/write-intent` / `fs/edit-intent` intent guards (the interception calls
+  the backend unconditionally, as a full replacement of the tool body), but
+  they DO emit `fs/observed` with a presence observation after success, exactly
+  like the shipped tools — so the observation layer stays coherent with the
+  file content a re-rooted write/edit produced.
 - `presentationMeta` is not computed on the short-circuit path; tool cards fall back to
   their default presentation.
 - `sandbox_permissions` escalation on `pwsh`/`bash` calls in secondary directories is

package/lib/client.js

@@ -214,12 +214,13 @@ window.__ModuleLoader__.load({
 
     // ------------------------------------------------------------- plugin
     var name = 'dsh-multi-folder';
-    var inject = ['remote', 'remote.commands', 'slots', 'workspaces', 'connection', 'sessions', 'locale'];
+    var inject = ['remote', 'remote.commands', 'slots', 'workspaces', 'uiWorkspace', 'connection', 'sessions', 'locale'];
 
     function apply(ctx) {
       var slots = ctx.slots;
       var remote = ctx.remote;
       var workspaces = ctx.workspaces;
+      var uiWorkspace = ctx.uiWorkspace;
       var connection = ctx.connection;
       var sessions = ctx.sessions;
       var locale = ctx.locale;
@@ -398,7 +399,18 @@ window.__ModuleLoader__.load({
       }
 
       function addDirectory() {
-        workspaces.pickDirectory().then(function (path) {
+        // DSH 0.1.2 moved the directory picker onto `uiWorkspace`; earlier
+        // shells kept it on `workspaces`. Pick whichever service actually
+        // exposes it (and call it with the right receiver), surfacing a clear
+        // error when neither does instead of throwing synchronously.
+        var picker = (uiWorkspace && typeof uiWorkspace.pickDirectory === 'function')
+          ? uiWorkspace
+          : (workspaces && typeof workspaces.pickDirectory === 'function') ? workspaces : null;
+        if (picker === null) {
+          patch({ error: 'multi-folder: the directory picker service is unavailable' });
+          return;
+        }
+        picker.pickDirectory().then(function (path) {
           if (path === null || path === undefined) return;
           var snapshot = getSnapshot();
           if (snapshot.sessionId) {
@@ -763,10 +775,22 @@ window.__ModuleLoader__.load({
       /** The shell's own hero predicate, read from the dock's owner share: a
        *  blank conversation with an open session. A still-loading blank
        *  session already lists as blank, so it may enter the hero phase
-       *  before the composer snapshot settles to `open`. */
+       *  before the composer snapshot settles to `open`.
+       *
+       *  DSH 0.1.2 exposes no `composerPhase` on SessionSnapshot; the hero
+       *  phase there is a settled blank session (mirroring ConversationRoot's
+       *  `hero = sessionId === undefined || (shellPhase === 'blank' && ...)`),
+       *  so the blank/lifecycle fields are used as the fallback. Newer DSH
+       *  shells that do carry `composerPhase` keep their original check. */
       function isHeroPhase(session, blank) {
         if (!session) return false;
-        return session.composerPhase === 'blank' && (session.openState === 'open' || blank === true);
+        if (session.composerPhase !== undefined) {
+          return session.composerPhase === 'blank' && (session.openState === 'open' || blank === true);
+        }
+        return session.blank === true
+          && !session.running
+          && !session.promptAttempted
+          && (blank === true || session.openState === 'open');
       }
 
       /** The workspace path a session belongs to, from the workspaces list. */

package/lib/index.js

@@ -16,6 +16,12 @@
  *    here with the session's standing sandbox policy re-rooted to that
  *    directory — identical semantics to the primary workspace in every mode
  *    (read-only denies, workspace-write allows, danger-full-access allows).
+ *    Interception hydrates the configuration AWAITED (never a fire-and-forget
+ *    read) and looks the dirs up by BOTH the policy root and the header cwd
+ *    spelling, so a cold first call and a symlinked workspace cannot fall
+ *    through to the default pipeline and surface a spurious workspace-write
+ *    denial for a secondary-directory mutation. Successful write/edit
+ *    short-circuits emit `fs/observed` like the shipped tools.
  *    Background shell runs (`run_in_background: true`) register with the
  *    generic jobs runtime (`ctx.jobs`) under the same re-rooted policy,
  *    mirroring the shipped pwsh/bash tools so `job_output` / `job_kill` and
@@ -539,8 +545,19 @@ export function apply(ctx) {
   }
 
   ctx.on('tools/execute', async (exec, next) => {
-    if (exec.agent && exec.agent.session && exec.agent.session.header) {
-      hydrate(exec.agent.session.header.cwd)
+    // Hydration must be AWAITED on the interception path, not fire-and-forget:
+    // a first call that arrives before the config read resolves would see an
+    // empty dirs cache, fall through to the default pipeline, and be fenced
+    // against the PRIMARY workspace root — surfacing as a spurious
+    // `[sandbox: file access denied under workspace-write mode]` for a
+    // secondary-directory write/edit. `loadDirs` caches, so only the first
+    // call pays the read.
+    const headerCwd =
+      exec.agent && exec.agent.session && exec.agent.session.header
+        ? exec.agent.session.header.cwd
+        : undefined
+    if (typeof headerCwd === 'string' && headerCwd.length > 0) {
+      await loadDirs(headerCwd)
     }
     if (!INTERCEPT_TOOLS.has(exec.name)) return next()
     try {
@@ -549,6 +566,13 @@ export function apply(ctx) {
       const primary = standing.workspaceRoot
       // An explicit escalation request belongs to the default pipeline.
       if (args && args.sandbox_permissions !== undefined) return next()
+      // The policy root is realpath-canonicalized by sandbox-policy while
+      // hydration is keyed by the session cwd as spelled in the header; on a
+      // workspace reached through a symlinked/junctioned ancestor the two
+      // spellings differ, so consult both keys before falling through.
+      const dirs =
+        dirsForSync(primary) ??
+        (typeof headerCwd === 'string' && headerCwd.length > 0 ? dirsForSync(headerCwd) : null)
 
       if (exec.name === 'write' || exec.name === 'edit') {
         const filePath = args && typeof args.file_path === 'string' ? args.file_path : null
@@ -559,15 +583,18 @@ export function apply(ctx) {
         const abs = fs.processPath(target)
         // Security boundary: configuration is user-managed. Reject direct
         // write/edit attempts against the host-owned config file, even before
-        // any directory matching.
-        if (wsKey(abs) === wsKey(configPathFor(primary))) {
+        // any directory matching. Both spellings of the workspace key are
+        // checked (see the dirs lookup above).
+        const guardHits = new Set(
+          [primary, headerCwd].filter((p) => typeof p === 'string' && p.length > 0).map((p) => wsKey(configPathFor(p))),
+        )
+        if (guardHits.has(wsKey(abs))) {
           return {
             isError: true,
             error: { message: 'multi-folder configuration is user-managed' },
             content: [{ type: 'text', text: CONFIG_GUARD_TEXT }],
           }
         }
-        const dirs = dirsForSync(primary)
         if (dirs === null) return next()
         const hit = longestRootFirst(dirs).find((d) => pathInside(abs, d))
         if (hit === undefined) return next()
@@ -575,6 +602,11 @@ export function apply(ctx) {
 
         if (exec.name === 'write') {
           const outcome = await fs.writeText(target, String(args.content), undefined, exec.signal, policy)
+          // Keep the observation layer coherent with the shipped write tool's
+          // contract: a successful create/update is a presence observation.
+          if (typeof ctx.emit === 'function') {
+            ctx.emit('fs/observed', target, { kind: 'present', version: outcome.version }, exec)
+          }
           const displayPath = displayPathOf(target, filePath)
           const value = {
             path: displayPath,
@@ -603,6 +635,9 @@ export function apply(ctx) {
           exec.signal,
           policy,
         )
+        if (typeof ctx.emit === 'function') {
+          ctx.emit('fs/observed', target, { kind: 'present', version: outcome.version }, exec)
+        }
         const displayPath = displayPathOf(target, filePath)
         const value = { path: displayPath, before: outcome.before, after: outcome.after }
         const text = replaceAll
@@ -614,7 +649,6 @@ export function apply(ctx) {
       if (exec.name === 'pwsh' || exec.name === 'bash') {
         const shell = ctx.get('shell')
         if (shell === undefined) return next()
-        const dirs = dirsForSync(primary)
         if (dirs === null) return next()
         const rawWorkdir = args && typeof args.workdir === 'string' ? args.workdir : null
         const joined = rawWorkdir === null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-folder",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "DeepSeek Harness plugin: secondary working directories for a project. The agent keeps the primary workspace as cwd, gains equal write/exec permissions on configured secondary directories under workspace-write mode, and is notified of configuration changes at the next message boundary. Configurable from the session header AND from the session-creation page (before the first message) through a sessionless multiFolder remote API.",
   "keywords": [
     "dsh-plugin",
@@ -42,6 +42,10 @@
     "compatibility": {
       "node": ">=20",
       "dshReleases": {
+        "0.1.2-alpha.5": "compatible",
+        "0.1.2-alpha.4": "compatible",
+        "0.1.2-alpha.3": "compatible",
+        "0.1.2-alpha.2": "compatible",
         "0.1.1-rc.2": "incompatible",
         "0.1.2-alpha.1": "compatible"
       }