@addozhang/dsh-discord 0.2.3 → 0.4.0

package/README.md

@@ -6,6 +6,7 @@
 [![CI](https://img.shields.io/github/actions/workflow/status/addozhang/dsh-discord/ci.yml?branch=main&label=CI)](https://github.com/addozhang/dsh-discord/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/@addozhang/dsh-discord)](./LICENSE)
 [![node](https://img.shields.io/node/v/@addozhang/dsh-discord)](./package.json)
+[![dshfind](https://dshfind.com/api/badge/addozhang/dsh-discord)](https://dshfind.com/en/plugins/addozhang/dsh-discord?ref=badge)
 
 A Discord-first adapter for [DeepSeek Harness](https://github.com/deepseek-ai): run DSH sessions from a Discord guild — mention the bot to open a task thread, steer and stop turns, answer approvals and questions inline, and watch the answer stream in.
 
@@ -17,7 +18,7 @@ This is a function/namespace plugin (`inject: ['apiProxy', 'credentials', 'setti
 
 ## Features
 
-- **Mention-driven sessions** — an authorized `@bot <task>` in a bound channel anchors a thread (the author's message becomes the first post), creates the DSH session, and submits the prompt at most once. Follow-ups inside the thread queue without a mention.
+- **Mention-driven sessions** — an authorized `@bot <task>` in a bound channel anchors a thread (the author's message becomes the first post), creates the DSH session, and submits the prompt at most once. Follow-ups inside the thread queue without a mention. Attached images ride along: they are downloaded from the Discord CDN within strict size/host bounds and submitted as image parts for multimodal models.
 - **Stream rendering** — typing indicators, a single edited head message, per-tool activity rows, fenced long-answer splitting, one-time finalize; the activity message is deleted when the turn ends.
 - **Approvals & questions** — DSH ask frames become Discord buttons, select menus, and a free-text modal; ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
 
@@ -109,6 +110,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/queue list`, `/queue remove` | session thread | inspect and trim the pending queue |
 | `/steer`, `/stop` | session thread | steer or cancel the running turn (owner only) |
 | `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
+| `/session resume` | project channel | pick one of this workspace's past sessions (autocomplete: title and age, newest first) and resume it into a new thread of this channel; blank, already-bound, subagent, and archived sessions are never offered |
 | `/guild forget` | any channel | operator-only removal of adapter records |
 
 ## Design notes
@@ -122,7 +124,6 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ## Known Limitations and Deferred Work
 
-- **`/session new|resume` is not registered** — the selector and cold-adoption modules are implemented and unit-tested, but the Host RPC face cannot back them yet (`sessions.list` v1 returns bare ids; no `session.inspect`). They return with the next milestone.
 - **`/preset`, `/skill`, and `/host` stay deregistered** — their control modules are implemented and unit-tested and return when the router wires them (the `/preset` thread-context guard rides along).
 - **Verbosity is a single global setting** (the DSH ecosystem has per-channel precedent).
 - **Deferred after a Kimaki parity pass**: reconcile-interactions wiring, typing pause during ask waits, fail-closed binding/session-owner store wiring, and credential-rotation watching.
@@ -132,7 +133,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 650 tests incl. gateway/REST twin E2E
+pnpm test          # 683 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/README.zh.md

@@ -6,6 +6,7 @@
 [![CI](https://img.shields.io/github/actions/workflow/status/addozhang/dsh-discord/ci.yml?branch=main&label=CI)](https://github.com/addozhang/dsh-discord/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/@addozhang/dsh-discord)](./LICENSE)
 [![node](https://img.shields.io/node/v/@addozhang/dsh-discord)](./package.json)
+[![dshfind](https://dshfind.com/api/badge/addozhang/dsh-discord)](https://dshfind.com/en/plugins/addozhang/dsh-discord?ref=badge)
 
 [DeepSeek Harness](https://github.com/deepseek-ai) 的 Discord 优先适配器：在 Discord 服务器中运行 DSH 会话——@机器人即可开启任务线程、插话与停止运行、在线审批与回答问题，并实时观看回答流式输出。
 
@@ -17,7 +18,7 @@
 
 ## 功能
 
-- **@提及驱动会话** — 在已绑定的频道中，被授权的 `@机器人 <任务>` 会锚定一个线程（你的消息成为首帖）、创建 DSH 会话，并且至多提交一次。线程内的后续消息无需 @ 即可排队。
+- **@提及驱动会话** — 在已绑定的频道中，被授权的 `@机器人 <任务>` 会锚定一个线程（你的消息成为首帖）、创建 DSH 会话，并且至多提交一次。线程内的后续消息无需 @ 即可排队。消息附带的图片会一并送达：在严格的大小与主机白名单约束下从 Discord CDN 下载，并作为 image parts 提交给多模态模型。
 - **流式渲染** — typing 指示、单条头消息编辑、逐工具活动行、代码围栏感知的长文分段、一次性收尾；Turn 结束时活动消息会被删除。
 - **审批与提问** — DSH ask 帧渲染为 Discord 按钮、下拉菜单与自由文本弹窗；所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
 
@@ -109,6 +110,7 @@ dsh-discord:
 | `/queue list`, `/queue remove` | 会话线程 | 查看与移除待处理队列 |
 | `/steer`, `/stop` | 会话线程 | 插话或取消运行中的 Turn（仅属主） |
 | `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
+| `/session resume` | 项目频道 | 自动补全选择本工作区的历史会话（显示标题与时间，最新优先），恢复为当前频道的新线程；空白、已挂线程、subagent、已归档的会话不会出现 |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
 
 
@@ -123,7 +125,6 @@ dsh-discord:
 
 ## 已知限制与推迟项
 
-- **`/session new|resume` 未注册** — 选择器与冷收养模块已实现并通过单元测试，但 Host RPC 面尚不支持（`sessions.list` v1 只返回裸 id；缺少 `session.inspect`）。将在下个里程碑回归。
 - **`/preset`、`/skill`、`/host` 保持注销状态** — 控制模块已实现并通过单元测试，待路由接线时回归（`/preset` 的会话线程守卫一并处理）。
 - **verbosity 为全局设置**（DSH 生态有按频道设置的先例）。
 - **经 Kimaki 对齐后有意推迟**：reconcile-interactions 接线、ask 等待期暂停 typing、fail-closed 绑定/会话属主 store 接线、凭据轮换监听。
@@ -133,7 +134,7 @@ dsh-discord:
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 650 tests incl. gateway/REST twin E2E
+pnpm test          # 683 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/lib/compose.d.ts

@@ -31,6 +31,13 @@ export interface SessionMainlinePort {
         authorId: string;
         workspaceId: string;
         prompt: string;
+        /** Declared image attachments carried by the message (16.50). */
+        images: ReadonlyArray<{
+            url: string;
+            filename: string;
+            declaredSize: number;
+            contentType: string;
+        }>;
     }): Promise<{
         outcome: 'admitted';
         threadId: string;
@@ -47,6 +54,9 @@ export interface SessionMainlinePort {
         outcome: 'prompt-rejected';
     } | {
         outcome: 'prompt-unknown';
+    } | {
+        outcome: 'image-failed';
+        reason: string;
     }>;
     continueInThread(request: {
         applicationId: string;
@@ -55,6 +65,13 @@ export interface SessionMainlinePort {
         sessionId: string;
         messageId: string;
         prompt: string;
+        /** Declared image attachments carried by the message (16.50). */
+        images: ReadonlyArray<{
+            url: string;
+            filename: string;
+            declaredSize: number;
+            contentType: string;
+        }>;
     }): Promise<{
         outcome: 'queued';
     } | {
@@ -65,6 +82,9 @@ export interface SessionMainlinePort {
         outcome: 'rejected';
     } | {
         outcome: 'unknown';
+    } | {
+        outcome: 'image-failed';
+        reason: string;
     }>;
 }
 export interface BindingsProbe {

package/lib/compose.js

@@ -18,10 +18,13 @@ export const GATEWAY_URL = 'wss://gateway.discord.gg/?v=10&encoding=json';
 export function routeEvent(deps, event, decision) {
     if (event.kind === 'message') {
         const prompt = event.content.trim();
+        const images = event.images;
+        // Text and images are independent task carriers: either alone admits.
+        const hasTask = prompt !== '' || images.length > 0;
         // Adapter-owned thread: ordinary continuation, no mention required.
         const sessionId = deps.bindings.sessionForThread(event.guildId, event.channelId);
         if (sessionId !== undefined) {
-            if (prompt === '')
+            if (!hasTask)
                 return;
             const request = {
                 applicationId: deps.applicationId(),
@@ -30,10 +33,11 @@ export function routeEvent(deps, event, decision) {
                 sessionId,
                 messageId: event.messageId,
                 prompt,
+                images,
             };
             void deps.mainline.continueInThread(request)
                 .then((result) => {
-                if (result.outcome === 'rejected' || result.outcome === 'unknown') {
+                if (result.outcome === 'rejected' || result.outcome === 'unknown' || result.outcome === 'image-failed') {
                     deps.logger?.warn('discord_continuation_not_queued', { ...result, messageId: event.messageId });
                 }
             })
@@ -63,7 +67,7 @@ export function routeEvent(deps, event, decision) {
             }
             return;
         }
-        if (prompt === '')
+        if (!hasTask)
             return;
         void deps.mainline.admitMention({
             applicationId: deps.applicationId(),
@@ -73,6 +77,7 @@ export function routeEvent(deps, event, decision) {
             authorId: event.authorId,
             workspaceId,
             prompt,
+            images,
         })
             .then((result) => {
             if (result.outcome !== 'admitted') {

package/lib/discord/commands.js

@@ -35,6 +35,12 @@ export const MILESTONE_ONE_COMMANDS = [
         // → reasoning cascade (16.35); typing `provider/model` applies directly.
         { name: 'select', options: [{ name: 'model', required: false }, { name: 'reasoning', required: false }] },
     ]),
+    grouped('session', 'Resume a DSH session into a new thread', [
+        // Typing filters live candidates by session title (autocomplete);
+        // /session new is deliberately absent — the @mention IS the new-session
+        // path (design.md §13).
+        { name: 'resume', options: [{ name: 'session', required: true, autocomplete: true }] },
+    ]),
     grouped('guild', 'Guild-scoped adapter operations', [
         { name: 'forget' },
     ]),

package/lib/dsh/api-proxy-face.d.ts

@@ -34,6 +34,10 @@ export interface DshApiProxyFace {
             content: Array<{
                 type: 'text';
                 text: string;
+            } | {
+                type: 'image';
+                mediaType: string;
+                data: string;
             }>;
         }>): Promise<RpcResponseShape<{
             accepted: true;
@@ -62,9 +66,7 @@ export interface DshApiProxyFace {
         list(request: RpcRequestShape<{
             cursor?: string;
         }>): Promise<RpcResponseShape<{
-            items: Array<{
-                sessionId: string;
-            }>;
+            items: SessionSummaryShape[];
         }>>;
         models(request: RpcRequestShape<{
             sessionId: string;
@@ -79,6 +81,29 @@ export interface DshApiProxyFace {
         }>>;
     };
 }
+/** Defensive read of the title projection in a list row's values. */
+export interface SessionProjectionsShape {
+    values?: {
+        title?: unknown;
+    };
+}
+/** The per-session summary `sessions.list` returns (rc.2 rich rows). */
+export interface SessionSummaryShape {
+    sessionId: string;
+    updatedAt: number;
+    running: boolean;
+    blank: boolean;
+    cwd?: string;
+    agentPreset?: string;
+    origin?: 'subagent';
+    projections?: SessionProjectionsShape;
+}
+/** The complete provider/model/reasoning selection (dsh-agent ModelSelection). */
+export interface ModelSelectionShape {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
 /** One reasoning effort a model's adapter advertises (sessions.d.ts). */
 import type { DshModelPort } from '../features/model-control.js';
 export interface ModelReasoningEffortShape {
@@ -115,12 +140,6 @@ export interface SessionModelsShape {
         message: string;
     }>;
 }
-/** The complete provider/model/reasoning selection (dsh-agent ModelSelection). */
-export interface ModelSelectionShape {
-    provider: string;
-    model: string;
-    reasoningEffort?: string;
-}
 /** Signature-layer narrow request form (RpcId brand erased at this seam). */
 export interface RpcRequestShape<P> {
     rpcId: string;
@@ -200,10 +219,16 @@ export type PromptOutcome = {
  * the turn may or may not have been admitted, so callers must not resubmit.
  * `options.rpcId` pins the adapter-owned stable request id, which the Host
  * records on the durable `user/message` (`source.rpcId`) for reconciliation.
+ * Images (16.50) encode as ordered `image` parts after the text part — the
+ * rc.2 `session.prompt` content is parts-shaped at this seam.
  */
 export declare function promptSession(dsh: DshApiProxyFace, request: {
     sessionId: string;
     prompt: string;
+    images?: ReadonlyArray<{
+        mediaType: string;
+        base64: string;
+    }>;
 }, options?: ApiProxyFaceOptions & {
     rpcId?: string;
 }): Promise<PromptOutcome>;
@@ -246,6 +271,31 @@ export type SessionIdListOutcome = {
 };
 /** List durable Session ids (`session.list`, v1 returns everything). */
 export declare function listSessionIds(dsh: DshApiProxyFace, options?: ApiProxyFaceOptions): Promise<SessionIdListOutcome>;
+/** A list row narrowed to what the /session resume surface renders. */
+export interface SessionResumeRow {
+    sessionId: string;
+    title: string | undefined;
+    updatedAt: number;
+    running: boolean;
+    blank: boolean;
+    cwd: string | undefined;
+    origin: 'subagent' | undefined;
+}
+export type SessionSummariesOutcome = {
+    outcome: 'completed';
+    sessions: SessionResumeRow[];
+} | {
+    outcome: 'failed';
+} | {
+    outcome: 'unknown';
+};
+/**
+ * The rich `sessions.list` for the /session resume surface: titles ride each
+ * row's projection values (absence = the session has no title yet), blank
+ * sessions are flagged, and rows arrive updatedAt-descending. Defensive
+ * narrowing: the wire is untrusted, extra/missing fields never throw.
+ */
+export declare function listSessionSummaries(dsh: DshApiProxyFace, options?: ApiProxyFaceOptions): Promise<SessionSummariesOutcome>;
 export type CancelOutcome = {
     outcome: 'accepted';
 } | {

package/lib/dsh/api-proxy-face.js

@@ -101,7 +101,19 @@ export function createWorkspaceCatalogPort(dsh, options = {}) {
                     workspaces: items.map(workspace => ({
                         id: workspace.workspaceId,
                         title: workspace.title,
+                        // The registered path rides every workspace.* row (Host
+                        // WorkspaceView); /session resume scopes candidates by it and
+                        // /project autocomplete abbreviates it — dropping it here once
+                        // silently emptied the resume list everywhere (16.46).
+                        ...(typeof workspace.path === 'string' ? { path: workspace.path } : {}),
                     })),
+                    // The registry's archived set rides the workspace.list value
+                    // (sessions.list rows carry NO archived marker): /session resume
+                    // subtracts it — resuming an archived session dead-ends in a
+                    // thread whose turns never run (16.49).
+                    archivedSessionIds: Array.isArray(result.value.archivedSessionIds)
+                        ? result.value.archivedSessionIds.filter((id) => typeof id === 'string')
+                        : [],
                 };
             }
             log?.('discord_workspace_list_rejected', {
@@ -162,6 +174,8 @@ export async function readWorkspaceDetail(dsh, reference, options = {}) {
  * the turn may or may not have been admitted, so callers must not resubmit.
  * `options.rpcId` pins the adapter-owned stable request id, which the Host
  * records on the durable `user/message` (`source.rpcId`) for reconciliation.
+ * Images (16.50) encode as ordered `image` parts after the text part — the
+ * rc.2 `session.prompt` content is parts-shaped at this seam.
  */
 export async function promptSession(dsh, request, options = {}) {
     return submitPromptTurn(dsh, { ...request, mode: 'queue' }, options);
@@ -181,7 +195,10 @@ async function submitPromptTurn(dsh, request, options) {
         response = await withRpcTimeout(dsh.sessions.prompt(mintRequest({
             sessionId: request.sessionId,
             mode: request.mode,
-            content: [{ type: 'text', text: request.prompt }],
+            content: [
+                { type: 'text', text: request.prompt },
+                ...(request.images ?? []).map(image => ({ type: 'image', mediaType: image.mediaType, data: image.base64 })),
+            ],
         }, options.rpcId)), timeoutMs);
     }
     catch (cause) {
@@ -271,6 +288,55 @@ export async function listSessionIds(dsh, options = {}) {
     log?.('discord_session_list_rejected', { code: result.error.code });
     return { outcome: 'failed' };
 }
+/**
+ * The rich `sessions.list` for the /session resume surface: titles ride each
+ * row's projection values (absence = the session has no title yet), blank
+ * sessions are flagged, and rows arrive updatedAt-descending. Defensive
+ * narrowing: the wire is untrusted, extra/missing fields never throw.
+ */
+export async function listSessionSummaries(dsh, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    let response;
+    try {
+        response = await withRpcTimeout(dsh.sessions.list(mintRequest({})), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_session_summaries_timeout', { timeoutMs });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_session_summaries_threw', { cause: String(cause) });
+        return { outcome: 'unknown' };
+    }
+    const result = response?.result;
+    if (result === undefined || !result.ok || !Array.isArray(result.value.items)) {
+        log?.('discord_session_summaries_malformed');
+        return { outcome: 'failed' };
+    }
+    const sessions = [];
+    // The wire is untrusted: narrow every row defensively before use.
+    const items = Array.isArray(result.value.items) ? result.value.items : [];
+    for (const item of items) {
+        if (typeof item !== 'object' || item === null)
+            continue;
+        const row = item;
+        if (typeof row.sessionId !== 'string' || row.sessionId === '')
+            continue;
+        const values = row.projections?.values;
+        const title = typeof values?.title === 'string' && values.title !== '' ? values.title : undefined;
+        sessions.push({
+            sessionId: row.sessionId,
+            title,
+            updatedAt: typeof row.updatedAt === 'number' ? row.updatedAt : 0,
+            running: row.running ?? false,
+            blank: row.blank === true,
+            cwd: typeof row.cwd === 'string' ? row.cwd : undefined,
+            origin: row.origin === 'subagent' ? 'subagent' : undefined,
+        });
+    }
+    return { outcome: 'completed', sessions };
+}
 /** Cancel the session's active turn (`session.cancel`); DSH preserves the pending inbox. */
 export async function cancelSessionViaProxy(dsh, request, options = {}) {
     const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;

package/lib/features/image-collection.d.ts

@@ -37,10 +37,21 @@ export interface ImageAttachment {
     declaredSize: number;
     contentType: string;
 }
+/**
+ * The production download port (16.50): every fetch rides the safe boundary
+ * — allowlisted Discord CDN hosts over HTTPS, one revalidated redirect hop,
+ * supported media types only.
+ */
+export declare function createSafeImageDownloadPort(): ImageDownloadPort;
 export type ImageCollectionResult = {
     outcome: 'collected';
     images: number;
     totalBytes: number;
+    /** The downloaded images in attachment order (16.50): callers encode them for submission. */
+    downloaded: ReadonlyArray<{
+        mediaType: string;
+        body: Uint8Array;
+    }>;
 } | {
     outcome: 'too-large';
     reason: 'declared' | 'actual' | 'aggregate';

package/lib/features/image-collection.js

@@ -8,10 +8,22 @@
  * bounded in practice by Discord CDN attachment limits and the aggregate
  * cap, not by streaming. Refusals are plain values.
  */
+import { createHttpFetchPort, fetchSafeImage } from './image-download.js';
 /** Per-image cap (design: bounded by DSH-advertised limits; adapter-capped). */
 export const MAX_IMAGE_BYTES = 8 * 1_024 * 1_024;
 /** Aggregate cap across all images of one message. */
 export const MAX_AGGREGATE_IMAGE_BYTES = 24 * 1_024 * 1_024;
+/**
+ * The production download port (16.50): every fetch rides the safe boundary
+ * — allowlisted Discord CDN hosts over HTTPS, one revalidated redirect hop,
+ * supported media types only.
+ */
+export function createSafeImageDownloadPort() {
+    const http = createHttpFetchPort();
+    return {
+        download: request => fetchSafeImage(http, { url: request.url }),
+    };
+}
 /**
  * Wrap the safe download boundary with byte-count enforcement: the body size
  * is checked against the remaining aggregate budget before it is accepted,
@@ -35,6 +47,7 @@ export function collectImages(port, request) {
     let remainingAggregate = MAX_AGGREGATE_IMAGE_BYTES;
     let images = 0;
     let totalBytes = 0;
+    const downloaded = [];
     const inner = port;
     async function run() {
         for (const attachment of request.attachments) {
@@ -50,30 +63,31 @@ export function collectImages(port, request) {
             const timeout = new Promise((resolve) => {
                 timer = setTimeout(() => { resolve('timeout'); }, request.timeoutMs);
             });
-            const downloaded = await Promise.race([
+            const downloadedImage = await Promise.race([
                 bounded.download({ url: attachment.url }).then((result) => result),
                 timeout,
             ]).finally(() => {
                 if (timer !== undefined)
                     clearTimeout(timer);
             });
-            if (downloaded === 'timeout')
+            if (downloadedImage === 'timeout')
                 return { outcome: 'timeout' };
-            if (downloaded.outcome === 'downloaded') {
-                if (downloaded.body.byteLength > MAX_IMAGE_BYTES) {
+            if (downloadedImage.outcome === 'downloaded') {
+                if (downloadedImage.body.byteLength > MAX_IMAGE_BYTES) {
                     return { outcome: 'too-large', reason: 'actual' };
                 }
                 images += 1;
-                totalBytes += downloaded.body.byteLength;
-                remainingAggregate -= downloaded.body.byteLength;
+                totalBytes += downloadedImage.body.byteLength;
+                remainingAggregate -= downloadedImage.body.byteLength;
+                downloaded.push({ mediaType: downloadedImage.mediaType, body: downloadedImage.body });
                 continue;
             }
-            if (downloaded.outcome === 'http-error' && downloaded.status === 413) {
+            if (downloadedImage.outcome === 'http-error' && downloadedImage.status === 413) {
                 return { outcome: 'too-large', reason: 'actual' };
             }
             return { outcome: 'download-failed' };
         }
-        return { outcome: 'collected', images, totalBytes };
+        return { outcome: 'collected', images, totalBytes, downloaded };
     }
     return run();
 }

package/lib/features/image-download.d.ts

@@ -46,3 +46,9 @@ export type SafeImageResult = {
 export declare function fetchSafeImage(port: HttpFetchPort, request: {
     url: string;
 }): Promise<SafeImageResult>;
+/**
+ * The production fetch boundary over the platform `fetch` (16.50). Redirects
+ * are NOT followed here — `fetchSafeImage` revalidates every hop itself —
+ * and the body is only read for a terminal 200 response.
+ */
+export declare function createHttpFetchPort(): HttpFetchPort;

package/lib/features/image-download.js

@@ -75,3 +75,24 @@ function isParseable(rawUrl) {
 export function fetchSafeImage(port, request) {
     return fetchOnce(port, MAX_REDIRECTS, request);
 }
+/**
+ * The production fetch boundary over the platform `fetch` (16.50). Redirects
+ * are NOT followed here — `fetchSafeImage` revalidates every hop itself —
+ * and the body is only read for a terminal 200 response.
+ */
+export function createHttpFetchPort() {
+    return {
+        async fetch(url) {
+            const response = await fetch(url, { redirect: 'manual' });
+            const location = response.headers.get('location');
+            const contentType = response.headers.get('content-type');
+            const body = response.status === 200 ? new Uint8Array(await response.arrayBuffer()) : undefined;
+            return {
+                status: response.status,
+                contentType: contentType ?? undefined,
+                location: location ?? undefined,
+                body,
+            };
+        },
+    };
+}

package/lib/features/interaction-router.d.ts

@@ -85,6 +85,48 @@ export interface InteractionRouterDeps {
     purgeChannelBinding: (guildId: string, channelId: string) => Promise<void>;
     /** The session's live model directory + selection mutation (/model surface). */
     model: DshModelPort;
+    /**
+     * /session resume autocomplete candidates: rich Host rows filtered to
+     * non-blank, unbound sessions, title-filtered, newest-first, capped at 25
+     * (16.44).
+     */
+    resumeCandidates: (query: string, workspacePath?: string, archivedSessionIds?: ReadonlySet<string>) => Promise<{
+        outcome: 'ok';
+        options: Array<{
+            label: string;
+            value: string;
+            description?: string;
+        }>;
+    } | {
+        outcome: 'unavailable';
+    }>;
+    /**
+     * Cold-adopt a session into a NEW thread of the bound project channel:
+     * anchor post → message-anchored thread creation → durable thread→session
+     * binding. Already-bound sessions resolve to their existing thread
+     * (16.44).
+     */
+    resumeSession: (input: {
+        sessionId: string;
+        workspaceId: string;
+        guildId: string;
+        parentChannelId: string;
+        actorId: string;
+    }) => Promise<{
+        outcome: 'started';
+        threadId: string;
+    } | {
+        outcome: 'already-bound';
+        threadId: string;
+    } | {
+        outcome: 'refused-control-channel';
+    } | {
+        outcome: 'refused-subagent';
+    } | {
+        outcome: 'refused-archived';
+    } | {
+        outcome: 'failed';
+    }>;
     /**
      * Whether /model select stays Host-operator-only (default). Single-user
      * deployments flip this so any authorized member can switch (16.42).