@addozhang/dsh-discord 0.4.0 → 0.5.0-alpha.2

package/README.md

@@ -8,9 +8,9 @@
 [![node](https://img.shields.io/node/v/@addozhang/dsh-discord)](./package.json)
 [![dshfind](https://dshfind.com/api/badge/addozhang/dsh-discord)](https://dshfind.com/en/plugins/addozhang/dsh-discord?ref=badge)
 
-A Discord-first adapter for [DeepSeek Harness](https://github.com/deepseek-ai): run DSH sessions from a Discord guild — mention the bot to open a task thread, steer and stop turns, answer approvals and questions inline, and watch the answer stream in.
+A Discord-first adapter for [DeepSeek Harness](https://github.com/deepseek-ai): run DSH sessions from your Discord guild — mention the bot with a task, a thread opens, the answer streams in, and approvals and questions arrive as buttons you can answer from your phone.
 
-This is a function/namespace plugin (`inject: ['apiProxy', 'credentials', 'settings', 'storageDomain', 'connection']`). It mounts the Discord Gateway, command surface, stream renderer, and the settings card onto a DSH web profile; session state lives in DSH and durable adapter bindings live in the profile's storage domain.
+No extra process: the adapter is a DSH plugin that mounts straight onto your `dsh web` profile. Session state stays in DSH; durable bindings live in the profile's storage domain.
 
 <p align="center">
   <img src="docs/images/discord-task-lifecycle.jpg" alt="One task lifecycle: the @mention anchors a thread, tool activity rows stream while the answer edits in place, and the final answer lands as Markdown tables" width="720">
@@ -18,19 +18,17 @@ This is a function/namespace plugin (`inject: ['apiProxy', 'credentials', 'setti
 
 ## Features
 
-- **Mention-driven sessions** — an authorized `@bot <task>` in a bound channel anchors a thread (the author's message becomes the first post), creates the DSH session, and submits the prompt at most once. Follow-ups inside the thread queue without a mention. Attached images ride along: they are downloaded from the Discord CDN within strict size/host bounds and submitted as image parts for multimodal models.
-- **Stream rendering** — typing indicators, a single edited head message, per-tool activity rows, fenced long-answer splitting, one-time finalize; the activity message is deleted when the turn ends.
-- **Approvals & questions** — DSH ask frames become Discord buttons, select menus, and a free-text modal; ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
-
-- **Session control** — `/steer`, `/stop`, `/queue list|remove` with turn-ownership checks; `/project bind|list|info` for guild↔workspace binding; `/guild forget` for operator cleanup.
-- **Model selection** — `/model show` reads the session's live model directory (current selection, routability, catalog groups); `/model select` walks an interactive provider → model → reasoning cascade (any authorized member by default; restrictable to Host operators), or applies a typed `provider/model` directly.
-- **Settings card** — token onboarding (paste + Connect; stored in the Host credential service, never in settings or logs), connect/disconnect, guild allowlist, thread auto-archive, and bot language.
-- **Bilingual copy** — every Discord-visible string ships in Chinese and English; the bot language defaults to following the DSH language preference and can be pinned from the card.
-- **Hardened by design** — deny-first authorization inside an explicit guild allowlist, mention suppression via `allowed_mentions` plus byte-level neutralization on every wire body, at-most-once DSH submission with unknown-preserving reconciliation, durable bindings that survive restarts, and a READY sweep that rebuilds the deleted category/control channel while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
+- **Mention-driven sessions** — an authorized `@bot <task>` in a bound channel anchors a thread (your message becomes the first post), creates the DSH session, and submits the prompt at most once. Follow-ups inside the thread queue without a mention. Attached images ride along: they are downloaded from the Discord CDN within strict size/host bounds and submitted as image parts for multimodal models.
+- **Stream rendering** — typing indicator, one head message edited in place, per-tool activity rows, fenced long-answer splitting, one-time finalize; the activity message is deleted when the turn ends.
+- **Approvals & questions** — DSH asks become buttons, select menus, and a free-text modal. Ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
+- **Session control** — `/steer`, `/stop`, and `/queue list|remove` with turn-ownership checks; `/project bind|list|info` and `/session resume` for guild↔workspace binding and history; `/guild forget` for operator cleanup.
+- **Model selection** — `/model show` reads the session's live model directory; `/model select` walks an interactive provider → model → reasoning cascade, or applies a typed `provider/model` directly. Open to any authorized member by default; restrictable to Host operators.
+- **Settings card, bilingual out of the box** — token onboarding and connect/disconnect (stored in the Host credential service, never in settings or logs), guild allowlist, auto-archive, and language. Every Discord-visible string ships in Chinese and English; the bot follows the DSH language preference or a pinned choice.
+- **Hardened by design** — deny-first authorization inside an explicit guild allowlist. Mentions are suppressed twice: `allowed_mentions` on every request, plus byte-level neutralization of the wire body. DSH submission is at-most-once with unknown-preserving reconciliation — an ambiguous delivery is never blindly resent. Bindings survive restarts, and the READY sweep rebuilds deleted category/control channels while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
 
 ## Requirements
 
-- The [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.1-rc.2` or newer, running a web profile
+- The [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.6-alpha.1` or a compatible newer release, running a web profile. Adapter `0.5.x` uses the 0.1.6 controller services and is not compatible with the former `apiProxy` host surface.
 - Node.js `^22.19.0 || >=24`
 - A Discord application with a bot user and the **MESSAGE CONTENT** privileged intent enabled (Developer Portal → your application → Bot → Privileged Gateway Intents)
 
@@ -42,7 +40,7 @@ Install with the dsh CLI — it installs the package into the profile and regist
 dsh plugin --profile web add @addozhang/dsh-discord
 ```
 
-Then restart `dsh web` and refresh the browser. Under the hood `dsh plugin` is a thin pnpm forwarder into the profile directory; after installing, it reconciles the profile's `dsh.profile.bundles` layer list and appends every dependency that declares a `dsh.bundle` patch — nothing to edit by hand.
+Then restart `dsh web` and refresh the browser. `dsh plugin` reconciles the profile's bundle list for you — nothing to edit by hand.
 
 Upgrade and removal use the same command:
 
@@ -115,12 +113,13 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ## Design notes
 
+- The adapter is a function/namespace plugin (`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`) that mounts the Discord Gateway, command surface, stream renderer, and the settings card onto the DSH web profile.
 - The settings card is the first-run onboarding surface: the token entry writes the credential service's `DSH_DISCORD_BOT_TOKEN` ref over the plugin management channel, then triggers the start chain. Disconnect keeps the credential; an empty reconnect uses it.
 - The publish workflow authenticates to npm via trusted publishing (OIDC) — no publish token is stored anywhere.
 - The adapter start chain is generation-counted, so Connect/Disconnect races with the initial boot yield exactly one gateway.
 - A credential probe falls back to `resolve()` because the Host's `describe()` misses env-sourced values — a connected adapter never reads as unconfigured.
 - Adapter logging is default-quiet: flow records ride the Host's debug level and failure-shaped events escalate to warn — nothing prints into the DSH process at the default level.
-- Wire-level live-path tracing: set `DSH_DISCORD_TRACE=1` before booting to emit mux frames, drop points, and delivery outcomes to stderr (default silent). It exists because the rc.2 Host wires no plugin log exporter and exposes no log-level switch — `logger.debug` output is unobservable — and should be dropped once the Host grows one.
+- Wire-level live-path tracing: set `DSH_DISCORD_TRACE=1` before booting to emit mux frames, drop points, and delivery outcomes to stderr (default silent). It exists because the Host wires no plugin log exporter and exposes no log-level switch at this surface — `logger.debug` output is unobservable — and should be dropped once the Host grows one.
 
 ## Known Limitations and Deferred Work
 

package/README.zh.md

@@ -8,9 +8,9 @@
 [![node](https://img.shields.io/node/v/@addozhang/dsh-discord)](./package.json)
 [![dshfind](https://dshfind.com/api/badge/addozhang/dsh-discord)](https://dshfind.com/en/plugins/addozhang/dsh-discord?ref=badge)
 
-[DeepSeek Harness](https://github.com/deepseek-ai) 的 Discord 优先适配器：在 Discord 服务器中运行 DSH 会话——@机器人即可开启任务线程、插话与停止运行、在线审批与回答问题，并实时观看回答流式输出。
+[DeepSeek Harness](https://github.com/deepseek-ai) 的 Discord 优先适配器：在 Discord 服务器中运行 DSH 会话——@机器人下一个任务，线程即开，回答流式输出，审批与提问以按钮形式送到手机上，随手即可回应。
 
-本插件为 function/namespace 插件（`inject: ['apiProxy', 'credentials', 'settings', 'storageDomain', 'connection']`）：将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile；会话状态保存在 DSH，适配器的持久绑定保存在 profile 的存储域中。
+零额外进程：适配器是 DSH 插件，直接挂载到你的 `dsh web` profile。会话状态保存在 DSH，持久绑定保存在 profile 的存储域中。
 
 <p align="center">
   <img src="docs/images/discord-task-lifecycle.jpg" alt="一次任务的完整生命周期：@提及锚定线程、工具活动行随回答流式编辑、最终以 Markdown 表格落地" width="720">
@@ -19,18 +19,16 @@
 ## 功能
 
 - **@提及驱动会话** — 在已绑定的频道中，被授权的 `@机器人 <任务>` 会锚定一个线程（你的消息成为首帖）、创建 DSH 会话，并且至多提交一次。线程内的后续消息无需 @ 即可排队。消息附带的图片会一并送达：在严格的大小与主机白名单约束下从 Discord CDN 下载，并作为 image parts 提交给多模态模型。
-- **流式渲染** — typing 指示、单条头消息编辑、逐工具活动行、代码围栏感知的长文分段、一次性收尾；Turn 结束时活动消息会被删除。
-- **审批与提问** — DSH ask 帧渲染为 Discord 按钮、下拉菜单与自由文本弹窗；所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
-
-- **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 管理 Guild↔工作区绑定；`/guild forget` 供操作员清理。
-- **模型切换** — `/model show` 读取会话的实时模型目录（当前选择、可服务状态、目录分组）；`/model select` 走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放，可通过设置收紧为仅 Host 操作员），也可直接填写 `provider/model` 应用。
-- **设置卡片** — Token 引导（粘贴 + 连接；存入 Host 凭据服务，绝不写入设置或日志）、连接/断开、服务器白名单、线程自动归档、Bot 语言。
-- **双语文案** — 所有 Discord 可见文案提供中英双语；Bot 语言默认跟随 DSH 语言偏好，也可从卡片固定。
-- **安全设计** — 显式服务器白名单内的 deny-first 授权、每条 wire 请求携带 `allowed_mentions` 并做字节级提及中和、至多一次的 DSH 提交与保留 unknown 的对账、重启后持久的绑定，以及 READY 扫描：被删的 category/控制频道会重建，被删的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
+- **流式渲染** — typing 指示、单条头消息原地编辑、逐工具活动行、代码围栏感知的长文分段、一次性收尾；Turn 结束时活动消息会被删除。
+- **审批与提问** — DSH 的 ask 渲染为按钮、下拉菜单与自由文本弹窗。所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
+- **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 与 `/session resume` 管理 Guild↔工作区绑定与历史会话；`/guild forget` 供操作员清理。
+- **模型切换** — `/model show` 读取会话的实时模型目录；`/model select` 走交互式 provider → 模型 → 推理强度级联，也可直接填写 `provider/model` 应用。默认对所有授权成员开放，可收紧为仅 Host 操作员。
+- **设置卡片，开箱双语** — Token 引导与连接/断开（存入 Host 凭据服务，绝不写入设置或日志）、服务器白名单、自动归档与语言。所有 Discord 可见文案提供中英双语；Bot 默认跟随 DSH 语言偏好，也可从卡片固定。
+- **安全设计** — 显式服务器白名单内的 deny-first 授权。提及抑制双保险：每条请求携带 `allowed_mentions`，外加 wire body 的字节级提及中和。DSH 提交至多一次，并做保留 unknown 的对账——结果不明的投递绝不盲目重发。绑定重启后持久；READY 扫描会重建被删除的 category/控制频道，而把被删除的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
 
 ## 环境要求
 
-- [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.1-rc.2` 或更新（web profile）
+- [dsh CLI](https://www.npmjs.com/package/@deepseek-ai/dsh) `0.1.6-alpha.1` 或兼容的更新版本（web profile）。适配器 `0.5.x` 使用 0.1.6 的控制器服务，与旧版 `apiProxy` 宿主面不兼容。
 - Node.js `^22.19.0 || >=24`
 - 一个 Discord 应用（含 Bot 用户），并在开发者门户启用 **MESSAGE CONTENT** 特权 intent（Developer Portal → 你的应用 → Bot → Privileged Gateway Intents）
 
@@ -42,7 +40,7 @@
 dsh plugin --profile web add @addozhang/dsh-discord
 ```
 
-然后重启 `dsh web` 并刷新浏览器。`dsh plugin` 底层是指向 profile 目录的 pnpm 薄转发；安装完成后它会自动对账 profile 的 `dsh.profile.bundles` 层列表，把所有声明了 `dsh.bundle` patch 的依赖追加进去——无需手动编辑。
+然后重启 `dsh web` 并刷新浏览器。`dsh plugin` 会自动对账 profile 的 bundle 列表——无需手动编辑。
 
 升级与卸载使用同一条命令：
 
@@ -116,12 +114,13 @@ dsh-discord:
 
 ## 设计说明
 
+- 适配器为 function/namespace 插件（`inject: ['sessionController', 'workspaceController', 'sessionQuery', 'webServer', 'credentials', 'settings', 'storageDomain', 'connection']`），将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile。
 - 设置卡片是首次使用的引导面：Token 输入通过插件管理通道写入凭据服务的 `DSH_DISCORD_BOT_TOKEN` 引用，然后触发启动链。断开连接保留凭据；留空重连直接使用已存 Token。
 - 发布工作流通过 npm trusted publishing (OIDC) 认证——任何地方都不保存发布凭证。
 - 适配器启动链带代际计数，Connect/Disconnect 与初始启动竞争时只会产生一个 Gateway。
 - 凭据探测会回退到 `resolve()`：Host 的 `describe()` 不识别环境变量来源的值——已连接的适配器不会被误报为未配置。
 - 适配器日志默认静默：流程记录走 Host 的 debug 级别，失败形态的事件升到 warn——默认级别下不会向 DSH 进程打印任何内容。
-- 链路级 trace：启动前设置 `DSH_DISCORD_TRACE=1` 可将 mux 帧、丢弃点与投递结果输出到 stderr（默认静默）。存在原因：rc.2 Host 未为插件日志接线任何 exporter，也没有日志级别开关——`logger.debug` 输出不可见；Host 提供等价机制后应移除。
+- 链路级 trace：启动前设置 `DSH_DISCORD_TRACE=1` 可将 mux 帧、丢弃点与投递结果输出到 stderr（默认静默）。存在原因：Host 在该面上未为插件日志接线任何 exporter，也没有日志级别开关——`logger.debug` 输出不可见；Host 提供等价机制后应移除。
 
 ## 已知限制与推迟项
 

package/cordis.patch.yml

@@ -11,4 +11,4 @@
 - insert:
     - id: dsh-discord
       name: '@addozhang/dsh-discord'
-      inject: [apiProxy, credentials, settings, storageDomain, connection]
+      inject: [sessionController, workspaceController, sessionQuery, webServer, credentials, settings, storageDomain, connection]

package/lib/client/card-controller.d.ts

@@ -4,7 +4,7 @@
  * hands to the component: the edit actions plus the `discordCard` snapshot
  * store the framework binds as the `useDiscordCard` selector hook.
  */
-import type { SettingsScope } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { AdapterStatusView } from '../features/adapter-status.js';
 import type { DiscordSettings } from '../settings.js';
 import { type CardManagement, type DiscordCardFace, type DiscordCardState } from './card-form.js';

package/lib/client/card-form.d.ts

@@ -6,7 +6,8 @@
  * not value comparison, marks an override. A field is invalid when its draft
  * is not a list of Discord IDs, which blocks the save rather than dropping it.
  */
-import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { AdapterStatusView } from '../features/adapter-status.js';
 import type { DiscordSettings } from '../settings.js';
 import { type AdapterStatusPresentation } from './settings-model.js';

package/lib/client/index.d.ts

@@ -3,10 +3,10 @@
  * namespace scope on its own fiber, owns the card controller, and registers
  * the settings card into the Plugins section's tab list until unload.
  */
-import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+import type { Context } from '@deepseek-ai/cordis';
 /** Stable Cordis plugin name for diagnostics. */
 export declare const name = "dsh-discord-client";
 /** Client services the card needs: settings transport, slot registry, plugin RPC channel, and locale. */
 export declare const inject: string[];
 /** Mount the Discord settings card into the Plugins section. */
-export declare function apply(ctx: ClientContext): void;
+export declare function apply(ctx: Context): void;

package/lib/client/slot-contract.d.ts

@@ -5,6 +5,13 @@
  * locale namespace the Discord card's copy lives in. Importing it is what
  * merges the declarations into this program.
  */
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        locale: {
+            register(namespace: string, dictionary: Record<string, Record<string, string>>): unknown;
+        };
+    }
+}
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         'dsh-discord': keyof DiscordPluginsLocale;

package/lib/client/snapshot-store.d.ts

@@ -4,6 +4,6 @@
  * factory, so the card implements the same interface locally and imports the
  * contract type only.
  */
-import type { SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
 /** Create an immutable-snapshot store with synchronous notification. */
 export declare function createLocalSnapshotStore<T>(initial: T): SnapshotStore<T>;

package/lib/compose.d.ts

@@ -1,7 +1,7 @@
 /**
  * The adapter composition root (review C1). Assembles the runtime the
  * module-level features could not wire themselves into: bot token → Gateway
- * → authorized ingress → business router → Discord REST / DSH apiProxy,
+ * → authorized ingress → business router → Discord REST / DSH host face,
  * plus the settings-card status feed. Everything injected is a port;
  * everything started here is torn down by the returned disposer.
  *
@@ -115,7 +115,7 @@ export interface CompositionDeps {
     status: AdapterStatusTracker;
     /**
      * Interaction (commands/components/modals) routing, wired by the Host
-     * composition where the typed apiProxy respond face lives.
+     * composition where the typed settle port lives.
      */
     routeInteraction?: (event: NormalizedInboundEvent, interactionToken?: string) => void | Promise<void>;
     /**

package/lib/compose.js

@@ -1,7 +1,7 @@
 /**
  * The adapter composition root (review C1). Assembles the runtime the
  * module-level features could not wire themselves into: bot token → Gateway
- * → authorized ingress → business router → Discord REST / DSH apiProxy,
+ * → authorized ingress → business router → Discord REST / DSH host face,
  * plus the settings-card status feed. Everything injected is a port;
  * everything started here is torn down by the returned disposer.
  *

package/lib/dsh/host-asks.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The 0.1.6 ask carrier. The composed-answerer waterfalls dispatch inside
+ * the base tree's context chain, and no registration surface reachable from
+ * an external plugin (own-tree listeners, global hooks, the shared events
+ * service, a bridge plugin on the approval service's own context) is
+ * enumerated by that dispatch — only in-tree plugins like the web
+ * forwarder receive it (verified empirically on the real host,
+ * 2026-09-18). The supported reach for an adapter is therefore the service
+ * boundary: this module wraps `ApprovalService.request` and
+ * `UserQuestionService.ask`, and for sessions bound to a Discord thread
+ * renders the ask through the adapter's ask-wiring (buttons, ownership,
+ * expiry) and resolves with the user's answer; every other ask passes
+ * through to the original path (the web UI keeps working unchanged).
+ */
+/** Narrow approval-request shape the service receives. */
+export interface HostApprovalRequest {
+    agent?: {
+        id?: string;
+    } | undefined;
+    toolName?: string;
+    callId?: string;
+    reason?: string;
+    signal?: AbortSignal;
+}
+/** Narrow user-question request shape the service receives. */
+export interface HostQuestionRequest {
+    agent?: {
+        id?: string;
+    } | undefined;
+    questions?: ReadonlyArray<Record<string, unknown>>;
+    signal?: AbortSignal;
+}
+/** The approval outcome vocabulary the service normalizes onto. */
+export type HostApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
+/** The answer payload the questions service resolves with. */
+export interface HostQuestionAnswer {
+    answers: Array<{
+        id: string;
+        selected: string[];
+        custom?: string;
+    }>;
+}
+/** Narrow approval-service face: the public ask entry we wrap. */
+export interface HostApprovalServiceFace {
+    request(req: HostApprovalRequest): Promise<HostApprovalOutcome>;
+}
+/** Narrow user-questions-service face: the public ask entry we wrap. */
+export interface HostQuestionServiceFace {
+    ask(req: HostQuestionRequest): Promise<HostQuestionAnswer>;
+}
+export interface HostAskDeps {
+    threadForSession(sessionId: string): string | undefined;
+    askWiring: {
+        onApprovalRequested(input: {
+            sessionId: string;
+            threadId: string;
+            rpcId: string;
+            approvalId: string;
+            toolName: string;
+            reason?: string | undefined;
+            expiresAtMs: number;
+        }): void;
+        onQuestionRequested(input: {
+            sessionId: string;
+            threadId: string;
+            rpcId: string;
+            expiresAtMs: number;
+            questions: ReadonlyArray<Record<string, unknown>>;
+        }): void;
+        disableControl(key: string): Promise<void>;
+    };
+    approvalTimeoutMs(): number;
+    questionTimeoutMs(): number;
+    nowMs(): number;
+    log(event: string, detail?: unknown): void;
+    /**
+     * Claim/settle steering for the live progress line (turn-progress spec):
+     * called with `true` when a thread-bound ask is claimed, `false` when it
+     * settles (answered, cancelled, or expired).
+     */
+    onWaitState?(threadId: string, waiting: boolean): void;
+}
+/**
+ * Wrap both ask services. Thread-bound sessions get the Discord ask flow;
+ * everything else passes through untouched. Returns the settle ports the
+ * click pipeline answers through, plus a dispose() the plugin teardown
+ * calls to restore the original entries.
+ */
+export declare function installAskServicePatches(approval: HostApprovalServiceFace, questions: HostQuestionServiceFace | undefined, deps: HostAskDeps): {
+    /** Settle one claimed approval ask; false when no pending ask owns the id. */
+    settleApproval(approvalId: string, outcome: HostApprovalOutcome): boolean;
+    /** Settle one claimed question ask; false when no pending ask owns the id. */
+    settleQuestion(rpcId: string, answer: HostQuestionAnswer): boolean;
+    /** Restore both services to their original entries. */
+    dispose(): void;
+};

package/lib/dsh/host-asks.js

@@ -0,0 +1,151 @@
+/**
+ * The 0.1.6 ask carrier. The composed-answerer waterfalls dispatch inside
+ * the base tree's context chain, and no registration surface reachable from
+ * an external plugin (own-tree listeners, global hooks, the shared events
+ * service, a bridge plugin on the approval service's own context) is
+ * enumerated by that dispatch — only in-tree plugins like the web
+ * forwarder receive it (verified empirically on the real host,
+ * 2026-09-18). The supported reach for an adapter is therefore the service
+ * boundary: this module wraps `ApprovalService.request` and
+ * `UserQuestionService.ask`, and for sessions bound to a Discord thread
+ * renders the ask through the adapter's ask-wiring (buttons, ownership,
+ * expiry) and resolves with the user's answer; every other ask passes
+ * through to the original path (the web UI keeps working unchanged).
+ */
+/** One claimed ask: a settle promise raced against the ask's abort signal. */
+class PendingAsk {
+    owner;
+    key;
+    settle = () => { };
+    promise;
+    cancel;
+    constructor(owner, key, signal, cancelled) {
+        this.owner = owner;
+        this.key = key;
+        this.promise = new Promise(resolve => {
+            this.settle = value => {
+                if (this.owner.get(this.key) !== this)
+                    return;
+                this.owner.delete(this.key);
+                resolve(value);
+            };
+        });
+        this.cancel = () => { this.settle(cancelled()); };
+        signal?.addEventListener('abort', this.cancel, { once: true });
+        // An already-aborted signal never fires its 'abort' event: settle now or
+        // the claim would hang past the host's own cancellation.
+        if (signal?.aborted === true)
+            this.cancel();
+    }
+    /** Resolve the ask; a no-op when it already settled. */
+    resolve(value) {
+        if (this.owner.get(this.key) !== this)
+            return false;
+        this.settle(value);
+        return true;
+    }
+    dispose() {
+        this.cancel();
+    }
+}
+/**
+ * Wrap both ask services. Thread-bound sessions get the Discord ask flow;
+ * everything else passes through untouched. Returns the settle ports the
+ * click pipeline answers through, plus a dispose() the plugin teardown
+ * calls to restore the original entries.
+ */
+export function installAskServicePatches(approval, questions, deps) {
+    const pendingApprovals = new Map();
+    const pendingQuestions = new Map();
+    // Capture the current entries (own or prototype) before patching; dispose
+    // restores exactly these.
+    const originalRequest = approval.request.bind(approval);
+    const originalAsk = questions !== undefined ? questions.ask.bind(questions) : undefined;
+    const patch = {
+        settleApproval(approvalId, outcome) {
+            return pendingApprovals.get(approvalId)?.resolve(outcome) ?? false;
+        },
+        settleQuestion(rpcId, answer) {
+            return pendingQuestions.get(rpcId)?.resolve(answer) ?? false;
+        },
+        dispose() {
+            approval.request = originalRequest;
+            if (questions !== undefined && originalAsk !== undefined) {
+                questions.ask = originalAsk;
+            }
+            for (const [, pending] of [...pendingApprovals])
+                pending.dispose();
+            pendingApprovals.clear();
+            for (const [, pending] of [...pendingQuestions])
+                pending.dispose();
+            pendingQuestions.clear();
+        },
+    };
+    approval.request = async (req) => {
+        const agentId = req.agent?.id;
+        const sessionId = agentId !== undefined && agentId !== '' ? agentId : undefined;
+        const threadId = sessionId !== undefined ? deps.threadForSession(sessionId) : undefined;
+        if (sessionId === undefined || threadId === undefined) {
+            deps.log('discord_ask_passthrough', { sessionId: sessionId ?? '', kind: 'approval' });
+            return originalRequest(req);
+        }
+        const approvalId = crypto.randomUUID();
+        deps.log('discord_approval_claimed', { approvalId, sessionId, threadId, toolName: req.toolName });
+        deps.onWaitState?.(threadId, true);
+        deps.askWiring.onApprovalRequested({
+            sessionId,
+            threadId,
+            // The settle port keys by approvalId; the rpcId field is vestigial in
+            // this model (no wire echo exists).
+            rpcId: approvalId,
+            approvalId,
+            toolName: typeof req.toolName === 'string' ? req.toolName : '',
+            reason: typeof req.reason === 'string' ? req.reason : undefined,
+            expiresAtMs: deps.nowMs() + deps.approvalTimeoutMs(),
+        });
+        const pending = new PendingAsk(pendingApprovals, approvalId, req.signal, () => 'cancelled');
+        pendingApprovals.set(approvalId, pending);
+        if (req.signal?.aborted === true)
+            pending.dispose();
+        void pending.promise.then(() => {
+            deps.onWaitState?.(threadId, false);
+            void deps.askWiring.disableControl(approvalId);
+        });
+        return pending.promise;
+    };
+    if (questions !== undefined && originalAsk !== undefined) {
+        questions.ask = async (req) => {
+            const agentId = req.agent?.id;
+            const sessionId = agentId !== undefined && agentId !== '' ? agentId : undefined;
+            const threadId = sessionId !== undefined ? deps.threadForSession(sessionId) : undefined;
+            if (sessionId === undefined || threadId === undefined) {
+                deps.log('discord_ask_passthrough', { sessionId: sessionId ?? '', kind: 'question' });
+                return originalAsk(req);
+            }
+            const rows = Array.isArray(req.questions) ? req.questions : [];
+            if (rows.length === 0)
+                return originalAsk(req);
+            const rpcId = crypto.randomUUID();
+            deps.log('discord_question_claimed', { rpcId, sessionId, threadId, questions: rows.length });
+            deps.onWaitState?.(threadId, true);
+            deps.askWiring.onQuestionRequested({
+                sessionId,
+                threadId,
+                rpcId,
+                expiresAtMs: deps.nowMs() + deps.questionTimeoutMs(),
+                questions: rows,
+            });
+            const cancelledAnswer = { answers: [] };
+            const pending = new PendingAsk(pendingQuestions, rpcId, req.signal, () => cancelledAnswer);
+            pendingQuestions.set(rpcId, pending);
+            if (req.signal?.aborted === true)
+                pending.dispose();
+            void pending.promise.then(() => {
+                deps.onWaitState?.(threadId, false);
+                void deps.askWiring.disableControl(rpcId);
+            });
+            return pending.promise;
+        };
+    }
+    return patch;
+}

package/lib/dsh/host-events.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The 0.1.6 host event bridge: fans the per-session `session/follow`
+ * journals plus the host-wide `session/control` stream into the single
+ * frame stream the live renderer consumes (the rc.2 `apiProxy.events.mux`
+ * global stream no longer exists).
+ *
+ * Frame vocabulary is preserved verbatim (`session/event`,
+ * `session/subscribed`, `session/queue`), so `src/stream/live.ts` and its
+ * tests are untouched by the host-side rebase. Two deliberate exclusions:
+ *
+ * - `snapshot` opening windows ARE translated through the same seq
+ *   watermark as live events: the turn often completes between prompt
+ *   admission and our follow subscription, so the opening window is the
+ *   ONLY carrier of those records. The watermark (last delivered seq per
+ *   session) keeps re-subscription replays idempotent.
+ * - approval/question request frames are NOT synthesized here: the 0.1.6
+ *   host routes asks through the composed-approval model, which the
+ *   ask-wiring migration wires separately.
+ */
+/** Narrow follow face over one durable session journal. */
+export interface HostSessionFollowFace {
+    follow(request: {
+        address: {
+            kind: 'session';
+            sessionId: string;
+        };
+        assistantStream?: true;
+    }, signal: AbortSignal): AsyncIterable<unknown>;
+    control(signal: AbortSignal): AsyncIterable<unknown>;
+}
+export interface HostEventRouterOptions {
+    log?: (event: string, detail?: unknown) => void;
+}
+/**
+ * The fan-in router. `track(sessionId)` is idempotent and safe to call from
+ * every session-acquisition site (create, adopt, resume, prompt); each
+ * tracked session owns one follow loop whose frames join the shared queue.
+ */
+export declare function createHostEventRouter(services: HostSessionFollowFace, options?: HostEventRouterOptions): {
+    track(sessionId: string): void;
+    stream(signal: AbortSignal): AsyncIterable<unknown>;
+};