Every release member now declares publishConfig.access: public, so the scope no
longer mixes levels: the 221 packages/*/* and apps/* manifests join the vendored
framework and the native packages.
check-workspace-constraints drops the per-sequence expectation and holds every
release member to public, which is what stops a member from drifting back.
Access is a property of the package, not of a version: the dsh packages already
published as restricted become world-readable at their next publication.
Local run of check:ci:windows-complete (the windows-native gate) on
latest master surfaced five Windows-only failures, all unreachable by
current CI because the native windows job is disabled and the wine gate
only covers build+site.
- install-lefthook/translation-pairing-merge specs junctioned the real
scripts/ and tsx package into fixtures; Windows recursive deletion
(Node rmSync and git worktree remove) follows MOUNT_POINT junctions and
deleted the repository's own directories mid-run. Fixtures now unlink
their reparse points before any recursive removal (shared helper in
scripts/test-fixture-cleanup.ts).
- workflow-workerthread spawned its worker with an empty env; on Windows
os.tmpdir() then degrades to the literal relative path undefined\temp,
so tsx wrote its transform cache into a cwd-relative undefined/
directory inside the repo. The worker env now injects the host temp
path on win32 (workerSpawnEnv, platform-parameterized and unit-tested
on both arms).
- workspace-context spec did not stub USERPROFILE (win32 homedir) or a
set DSH_HOME, leaking the developer machine's real ~/.dsh/AGENTS.md
into discovery.
- ui-trajectory client-bundle spec mounted the built artifact without the
remote/settingsScope provides the locale plugin needs, so the plugin
never activated and no view registered.
- subagent temp-fixture cleanup lacked the maxRetries Windows handle
release needs under load (EPERM); added retries to the three affected
specs and the fixture-cleanup helper.
Overlaps master on the preset e2e, the web scaffold, and the generated
config-catalog triplet; all merged textually, so the catalog is regenerated and
its pairing hashes re-recorded rather than trusted.
wireSchemas() already advertised only run_code under mode: 'code', but the
executor resolved every call through get(), which returns the full visible
map plus the reserved transport. A model could name a native tool directly
and bypass run_code entirely. Route the execution-path lookups through a
new private resolveExecution() that applies the mode collapse at the
operation boundary: model-direct calls under 'code' may only name run_code
(UNKNOWN_TOOL otherwise), while SDK sub-dispatches (parent token set) keep
every visible tool. get()/schemas() public semantics are unchanged.
The denial happens at createExecution, before the extensible policy
pipeline — pre-execute listeners, approval ask, and guards never observe
a call that is deterministically denied. A collapsed call honors the
pre-dispatch cancellation contract, routes aborted results through the
visible tool's finalizeContent, and captures the finalizer before
argument materialization.
Regenerated docs, catalogs, graphs, scoped events, re-recorded
translation pairs, and updated test assertions.
Fixes#1815
`Config.roots` defaulted to `[]`, so a deployment that did not patch both roots
in got a roster with none — `dsh run` once booted exactly that and failed
resolving `standard`. The user root never needed an app: `<dshHome>/.agent-presets`
is the same place in every deployment, resolvable here the way
`dsh-skill-local` resolves `<dshHome>/skills`.
The roster now derives that root itself unless `includeUserRoot` is false, and
`apps/cli` supplies only the SHIPPED root, whose path an installed app alone
can resolve. The derived root is appended after every configured root, so a
shipped id still shadows a home directory claiming it and `writableRoot()`
still prefers an explicitly configured `user` root; the set is resolved once at
construction, because a root set that changed between a `list()` and the
`copy()` acting on its answer would author into a directory the caller never
saw.
Every test that pins an exact roster now says `includeUserRoot: false` — the
machine's real harness home must not decide what a golden or an assertion
counts.
