@addozhang/dsh-discord 0.4.0 → 0.5.0-alpha.2

package/lib/dsh/host-face.js

@@ -0,0 +1,598 @@
+/**
+ * The typed防腐层 over the Host's 0.1.6 controller services — the cordis
+ * services `sessionController`, `workspaceController`, and `sessionQuery`
+ * that replaced the 0.1.1-rc.2 `apiProxy` gateway. Domain methods speak the
+ * typert faces directly: plain request objects in, plain values out, and
+ * business rejections carried as thrown `RemoteError`s (`{code, message}`).
+ * Two guarantees are preserved from the rc.2 seam:
+ *
+ * 1. Boundedness — a Host that never answers must not wedge an interaction
+ *    handler (or a Discord ephemeral) forever; every call races a timeout and
+ *    resolves to an unobservable outcome instead.
+ * 2. Observability — every terminal outcome is reported through the injected
+ *    log sink, so a silent-void call can never again be misread as a hang.
+ *
+ * The exported port-level API (function names, outcome unions) is unchanged
+ * from the rc.2 face: the Discord features and their tests keep their
+ * vocabulary while this module alone absorbs the host-side rebase.
+ */
+import { parseWorkspaceReference } from '../policy/disclosure.js';
+/**
+ * Resolve the 0.1.6 controller services off the Cordis context. Throws one
+ * actionable TypeError naming every absent service — the composition root
+ * treats that as a fail-loud startup boundary, never a silent half-mount.
+ */
+export function resolveHostFace(ctx) {
+    const missing = [];
+    for (const name of ['sessionController', 'workspaceController', 'sessionQuery']) {
+        if (ctx.get(name) === undefined || ctx.get(name) === null)
+            missing.push(name);
+    }
+    if (missing.length > 0) {
+        throw new TypeError(`dsh-discord requires the 0.1.6 host controller services; missing ${missing.map(name => `'${name}'`).join(', ')}`);
+    }
+    return {
+        session: ctx.get('sessionController'),
+        workspace: ctx.get('workspaceController'),
+        sessionQuery: ctx.get('sessionQuery'),
+    };
+}
+/** Raised when the Host did not answer within the bounded window. */
+export class RpcTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`dsh host call did not answer within ${String(timeoutMs)}ms`);
+        this.name = 'RpcTimeoutError';
+    }
+}
+/** Race one host promise against a bounded window. */
+export function withRpcTimeout(promise, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => { reject(new RpcTimeoutError(timeoutMs)); }, timeoutMs);
+    });
+    return Promise.race([promise, timeout]).finally(() => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    });
+}
+/** Default bounded window for unary catalog reads (local, no model work). */
+const CATALOG_TIMEOUT_MS = 5_000;
+/** Default bounded window for prompt admission (the Host may enqueue). */
+const PROMPT_TIMEOUT_MS = 30_000;
+/** Default bounded window for the model directory read. */
+const MODELS_TIMEOUT_MS = 10_000;
+/**
+ * A definitive Host business rejection: the 0.1.6 controllers throw
+ * `RemoteError` ({code, message}) for every admission refusal. Anything else
+ * in a catch is a host fault, not a business verdict.
+ */
+function remoteRejectionOf(error) {
+    const code = error?.code;
+    return typeof code === 'string' && code !== '' ? { code } : undefined;
+}
+/** Defensive record probe: the wire is untrusted regardless of declared types. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Map a Host RemoteError code onto the adapter's stable internal vocabulary:
+ * the `session/` namespace prefix is stripped (`session/agent-busy` →
+ * `agent-busy`), matching the rc.2 reasons the Discord copy interpolates.
+ * Unknown namespaces pass through verbatim.
+ */
+function rejectionReason(error) {
+    const rejection = remoteRejectionOf(error);
+    if (rejection === undefined)
+        return 'host-error';
+    return rejection.code.startsWith('session/')
+        ? rejection.code.slice('session/'.length)
+        : rejection.code;
+}
+/** Pull exactly the first frame of one stream (the opening baseline). */
+function firstFrameOf(stream) {
+    const iterator = stream[Symbol.asyncIterator]();
+    return iterator.next().then(result => {
+        if (result.done === true)
+            throw new Error('workspace stream closed before the baseline frame');
+        return result.value;
+    });
+}
+/**
+ * Read the registry baseline as the follow stream's opening frame: one
+ * short-lived subscription, aborted the moment the baseline lands. Returns
+ * the narrowed baseline record, or undefined when the frame is malformed.
+ */
+async function readWorkspaceBaseline(dsh, timeoutMs) {
+    const per = new AbortController();
+    let frame;
+    try {
+        frame = await withRpcTimeout(firstFrameOf(dsh.workspace.follow(per.signal)), timeoutMs);
+    }
+    finally {
+        per.abort();
+    }
+    const value = isRecord(frame) && frame['type'] === 'baseline' ? frame['value'] : undefined;
+    if (!isRecord(value) || !Array.isArray(value['items']))
+        throw new Error('workspace baseline frame is malformed');
+    return {
+        items: value['items'],
+        archivedSessionIds: Array.isArray(value['archivedSessionIds']) ? value['archivedSessionIds'] : [],
+    };
+}
+/**
+ * The bind flow's catalog verifier: resolves an opaque `ws:` reference
+ * against the live workspace baseline. A well-formed reference the registry
+ * no longer knows — and any malformed one — resolve `stale` (fail-closed, no
+ * write can follow); a Host error is `failed`; a timeout is `unknown`.
+ */
+export function createWorkspaceResolver(dsh, options = {}) {
+    const port = createWorkspaceCatalogPort(dsh, options);
+    return {
+        async resolve(reference) {
+            const catalog = await port.listWorkspaces();
+            if (catalog.outcome !== 'completed') {
+                return catalog.outcome === 'unknown' ? { outcome: 'unknown' } : { outcome: 'failed' };
+            }
+            const id = parseWorkspaceReference(reference);
+            const found = id === undefined
+                ? undefined
+                : catalog.workspaces.find(workspace => workspace.id === id);
+            return found === undefined
+                ? { outcome: 'stale' }
+                : { outcome: 'found', workspace: { id: found.id, title: found.title } };
+        },
+    };
+}
+/**
+ * The `/project list` catalog port over the workspace registry baseline.
+ * Outcomes follow the port contract: a definitive Host error is `failed`
+ * (sanitized before Discord), while a timeout or unreadable body is
+ * `unknown` — delivery was not observed, so no retry is implied.
+ */
+export function createWorkspaceCatalogPort(dsh, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    return {
+        async listWorkspaces() {
+            let baseline;
+            try {
+                baseline = await readWorkspaceBaseline(dsh, timeoutMs);
+            }
+            catch (cause) {
+                if (cause instanceof RpcTimeoutError) {
+                    log?.('discord_workspace_list_timeout', { timeoutMs });
+                    return { outcome: 'unknown' };
+                }
+                log?.('discord_workspace_list_threw', { cause: String(cause) });
+                return { outcome: 'failed' };
+            }
+            if (!isRecord(baseline) || !Array.isArray(baseline['items'])) {
+                log?.('discord_workspace_list_malformed');
+                return { outcome: 'failed' };
+            }
+            const rows = baseline['items'];
+            return {
+                outcome: 'completed',
+                workspaces: rows
+                    .filter(workspace => isRecord(workspace) && typeof workspace['workspaceId'] === 'string' && workspace['workspaceId'] !== '')
+                    .map(workspace => {
+                    const row = workspace;
+                    return {
+                        id: row.workspaceId,
+                        title: typeof row.title === 'string' ? row.title : row.workspaceId,
+                        // The registered path rides every baseline row (Host
+                        // WorkspaceView); /session resume scopes candidates by it and
+                        // /project autocomplete abbreviates it — dropping it here once
+                        // silently emptied the resume list everywhere (16.46).
+                        ...(typeof row.path === 'string' ? { path: row.path } : {}),
+                    };
+                }),
+                // The registry's archived set rides the baseline (session.list rows
+                // carry NO archived marker): /session resume subtracts it — resuming
+                // an archived session dead-ends in a thread whose turns never run
+                // (16.49).
+                archivedSessionIds: Array.isArray(baseline['archivedSessionIds'])
+                    ? baseline['archivedSessionIds'].filter((id) => typeof id === 'string')
+                    : [],
+            };
+        },
+    };
+}
+/**
+ * Read one Workspace's full view (title plus canonical path). The path is
+ * for the administrator-only ephemeral info response — the disclosure
+ * policy owns whether it ever renders; this face only carries it in memory.
+ */
+export async function readWorkspaceDetail(dsh, reference, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    let baseline;
+    try {
+        baseline = await readWorkspaceBaseline(dsh, timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_workspace_detail_timeout', { timeoutMs });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_workspace_detail_threw', { cause: String(cause) });
+        return { outcome: 'failed' };
+    }
+    const items = Array.isArray(baseline.items) ? baseline.items : [];
+    const id = parseWorkspaceReference(reference) ?? (reference === '' ? undefined : reference);
+    const found = items.find(workspace => workspace.workspaceId === id);
+    if (found === undefined)
+        return { outcome: 'stale' };
+    return {
+        outcome: 'found',
+        workspace: {
+            id: found.workspaceId,
+            title: found.title,
+            path: typeof found.path === 'string' ? found.path : undefined,
+        },
+    };
+}
+/**
+ * Submit one prompt turn through the session controller. A definitive Host
+ * rejection (thrown RemoteError) is a rejection carrying the sanitized
+ * reason; a timeout or host fault is `unknown` — the turn may or may not
+ * have been admitted, so callers must not resubmit. `options.rpcId` pins
+ * the adapter-owned stable request id, which the Host records on the
+ * durable user message (`source.rpcId`) and de-duplicates on — the 0.1.6
+ * admission layer replays `{accepted: true}` for a repeated id, keeping the
+ * at-most-once discipline observable. Images (16.50) encode as ordered
+ * `image` parts after the text part.
+ */
+export async function promptSession(dsh, request, options = {}) {
+    return submitPromptTurn(dsh, { ...request, mode: 'queue' }, options);
+}
+/**
+ * Steer the session's active turn: `session.prompt` with `mode: 'steer'`,
+ * carrying the same stable request-id discipline as the queue path.
+ */
+export async function steerSession(dsh, request, options = {}) {
+    return submitPromptTurn(dsh, { ...request, mode: 'steer' }, options);
+}
+async function submitPromptTurn(dsh, request, options) {
+    const timeoutMs = options.timeoutMs ?? PROMPT_TIMEOUT_MS;
+    const log = options.log;
+    const per = new AbortController();
+    try {
+        await withRpcTimeout(dsh.session.prompt({
+            requestId: options.rpcId ?? crypto.randomUUID(),
+            sessionId: request.sessionId,
+            mode: request.mode,
+            content: [
+                { type: 'text', text: request.prompt },
+                ...(request.images ?? []).map(image => ({ type: 'image', mediaType: image.mediaType, data: image.base64 })),
+            ],
+        }, per.signal), timeoutMs);
+        // The controller schema pins accepted to literal true; admission
+        // returning at all is the accepted verdict.
+        return { outcome: 'accepted' };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_prompt_submit_timeout', { timeoutMs, sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        if (rejection !== undefined) {
+            log?.('discord_prompt_submit_rejected', {
+                code: rejection.code,
+                sessionId: request.sessionId,
+            });
+            return { outcome: 'rejected', reason: rejectionReason(cause) };
+        }
+        log?.('discord_prompt_submit_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    finally {
+        // The host checks the signal only before admission; releasing it after
+        // the bounded window keeps the caller's cancellation observable.
+        per.abort();
+    }
+}
+/**
+ * Create one DSH Session against a preallocated id (design.md §10): the 0.1.6
+ * controller adopts the same session id idempotently, so an uncertain
+ * response never forks a second Session. Same outcome discipline as the
+ * prompt path.
+ */
+export async function createSessionViaProxy(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? PROMPT_TIMEOUT_MS;
+    const log = options.log;
+    try {
+        const value = await withRpcTimeout(dsh.session.create({
+            workspaceId: request.workspaceId,
+            sessionId: request.sessionId,
+        }), timeoutMs);
+        if (!isRecord(value) || typeof value['sessionId'] !== 'string') {
+            log?.('discord_session_create_malformed', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        return { outcome: 'completed', sessionId: value['sessionId'] };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_session_create_timeout', { timeoutMs, sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        if (rejection !== undefined) {
+            log?.('discord_session_create_rejected', { code: rejection.code, sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: rejectionReason(cause) };
+        }
+        log?.('discord_session_create_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+}
+/** List durable Session ids (`session.list` returns everything in one page). */
+export async function listSessionIds(dsh, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    let items;
+    try {
+        const value = await withRpcTimeout(dsh.session.list(undefined), timeoutMs);
+        // In-process the controller returns the BARE array; the {items} envelope
+        // is the typert wire shape. Accept both.
+        items = Array.isArray(value) ? value : (isRecord(value) && Array.isArray(value['items']) ? value['items'] : []);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_session_list_timeout', { timeoutMs });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_session_list_threw', { cause: String(cause) });
+        return { outcome: 'unknown' };
+    }
+    const ids = [];
+    for (const item of items) {
+        const row = item;
+        if (typeof row.sessionId === 'string' && row.sessionId !== '')
+            ids.push(row.sessionId);
+    }
+    return { outcome: 'completed', ids };
+}
+/**
+ * The rich `session.list` for the /session resume surface: titles ride each
+ * row's projection values (absence = the session has no title yet), blank
+ * sessions are flagged, and rows arrive updatedAt-descending. Defensive
+ * narrowing: the wire is untrusted, extra/missing fields never throw.
+ */
+export async function listSessionSummaries(dsh, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    let items;
+    try {
+        const value = await withRpcTimeout(dsh.session.list(undefined), timeoutMs);
+        // In-process the controller returns the BARE array; the {items} envelope
+        // is the typert wire shape. Accept both.
+        items = Array.isArray(value) ? value : (isRecord(value) && Array.isArray(value['items']) ? value['items'] : []);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_session_summaries_timeout', { timeoutMs });
+            return { outcome: 'unknown' };
+        }
+        log?.('discord_session_summaries_threw', { cause: String(cause) });
+        return { outcome: 'unknown' };
+    }
+    const sessions = [];
+    // The wire is untrusted: narrow every row defensively before use.
+    for (const item of items) {
+        if (typeof item !== 'object' || item === null)
+            continue;
+        const row = item;
+        if (typeof row.sessionId !== 'string' || row.sessionId === '')
+            continue;
+        const values = row.projections?.values;
+        const title = typeof values?.title === 'string' && values.title !== '' ? values.title : undefined;
+        sessions.push({
+            sessionId: row.sessionId,
+            title,
+            updatedAt: typeof row.updatedAt === 'number' ? row.updatedAt : 0,
+            running: row.running ?? false,
+            blank: row.blank === true,
+            cwd: typeof row.cwd === 'string' ? row.cwd : undefined,
+            origin: row.origin === 'subagent' ? 'subagent' : undefined,
+        });
+    }
+    return { outcome: 'completed', sessions };
+}
+/** Cancel the session's active turn (`session.cancel`); DSH preserves the pending inbox. */
+export async function cancelSessionViaProxy(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    try {
+        await withRpcTimeout(dsh.session.cancel({ sessionId: request.sessionId }), timeoutMs);
+        return { outcome: 'accepted' };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_session_cancel_timeout', { timeoutMs, sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        if (rejection !== undefined) {
+            log?.('discord_session_cancel_rejected', { code: rejection.code, sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: rejectionReason(cause) };
+        }
+        log?.('discord_session_cancel_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+}
+/** Remove one pending inbox item (`session.updateQueue`, action remove). */
+export async function removeQueueItemViaProxy(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? CATALOG_TIMEOUT_MS;
+    const log = options.log;
+    try {
+        await withRpcTimeout(dsh.session.updateQueue({
+            sessionId: request.sessionId,
+            itemId: request.itemId,
+            action: { kind: 'remove' },
+        }), timeoutMs);
+        return { outcome: 'accepted' };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_queue_remove_timeout', { timeoutMs, sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        if (rejection !== undefined) {
+            log?.('discord_queue_remove_rejected', { code: rejection.code, sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: rejectionReason(cause) };
+        }
+        log?.('discord_queue_remove_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+}
+/**
+ * Read the session's live selection off the `modelSelection` projection
+ * (wired view `{lastUsed, next}`); defensively accept either wired or raw
+ * (`pending`) state shapes. Any read failure resolves undefined — the
+ * catalog default takes over, never a hard failure.
+ */
+async function readSessionSelection(dsh, sessionId, options) {
+    const log = options.log;
+    let observation;
+    try {
+        observation = await withRpcTimeout(dsh.sessionQuery.observeSession(sessionId), options.timeoutMs ?? CATALOG_TIMEOUT_MS);
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const projections = isRecord(observation) && isRecord(observation['projections'])
+            ? observation['projections']
+            : undefined;
+        const values = projections !== undefined && isRecord(projections['values'])
+            ? projections['values']
+            : undefined;
+        const selection = (values !== undefined ? values['modelSelection'] : undefined);
+        const candidate = selection?.next ?? selection?.pending ?? selection?.lastUsed;
+        if (candidate === null || candidate === undefined)
+            return undefined;
+        const typed = candidate;
+        if (typeof typed.provider !== 'string' || typeof typed.model !== 'string')
+            return undefined;
+        return {
+            provider: typed.provider,
+            model: typed.model,
+            ...(typeof typed.reasoningEffort === 'string' ? { reasoningEffort: typed.reasoningEffort } : {}),
+        };
+    }
+    finally {
+        const dispose = observation?.[Symbol.asyncDispose]
+            ?? observation?.dispose;
+        if (typeof dispose === 'function') {
+            try {
+                void dispose.call(observation);
+            }
+            catch (cause) {
+                log?.('discord_session_selection_dispose_threw', { cause: String(cause) });
+            }
+        }
+    }
+}
+/**
+ * The session's detached model directory: the live selection, whether its
+ * route still serves, and the per-provider catalog groups the /model
+ * cascade browses. Composed from the 0.1.6 global `modelCatalog` plus the
+ * session's `modelSelection` projection — the rc.2 per-session
+ * `sessions.models` RPC no longer exists.
+ */
+export async function sessionModels(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? MODELS_TIMEOUT_MS;
+    const log = options.log;
+    let catalog;
+    try {
+        catalog = await withRpcTimeout(dsh.session.modelCatalog(), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_models_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        log?.('discord_models_failed', { sessionId: request.sessionId, code: rejection?.code ?? 'malformed' });
+        return { outcome: 'failed' };
+    }
+    if (!isRecord(catalog) || !Array.isArray(catalog['groups'])) {
+        log?.('discord_models_malformed', { sessionId: request.sessionId });
+        return { outcome: 'failed' };
+    }
+    const selection = await readSessionSelection(dsh, request.sessionId, options);
+    const fallback = isRecord(catalog['default']) ? catalog['default'] : {};
+    const current = selection ?? {
+        provider: typeof fallback['provider'] === 'string' ? fallback['provider'] : '',
+        model: typeof fallback['model'] === 'string' ? fallback['model'] : '',
+        ...(typeof fallback['reasoningEffort'] === 'string' ? { reasoningEffort: fallback['reasoningEffort'] } : {}),
+    };
+    const routableProviders = Array.isArray(catalog['routableProviders']) ? catalog['routableProviders'] : [];
+    const routable = routableProviders.includes(current.provider);
+    return {
+        outcome: 'completed',
+        models: {
+            current,
+            routable,
+            groups: catalog['groups'],
+            failures: Array.isArray(catalog['failures']) ? catalog['failures'] : [],
+        },
+    };
+}
+/**
+ * Select the complete model selection for one session (session.selectModel):
+ * the session switches immediately and the Host records the choice as the
+ * default for sessions that have not logged their own — the response only
+ * proves the session switch, so callers must not claim the persistence
+ * outcome (design.md §7).
+ */
+export async function selectSessionModel(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? PROMPT_TIMEOUT_MS;
+    const log = options.log;
+    try {
+        const value = await withRpcTimeout(dsh.session.selectModel({
+            sessionId: request.sessionId,
+            provider: request.provider,
+            model: request.model,
+            ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
+        }), timeoutMs);
+        const selected = isRecord(value) ? value['selected'] : undefined;
+        if (!isRecord(selected) || typeof selected['provider'] !== 'string' || typeof selected['model'] !== 'string') {
+            log?.('discord_model_select_malformed', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const chosen = {
+            provider: selected['provider'],
+            model: selected['model'],
+            ...(typeof selected['reasoningEffort'] === 'string' ? { reasoningEffort: selected['reasoningEffort'] } : {}),
+        };
+        return { outcome: 'completed', selected: chosen };
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            log?.('discord_model_select_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        const rejection = remoteRejectionOf(cause);
+        if (rejection !== undefined) {
+            log?.('discord_model_select_rejected', { code: rejection.code, sessionId: request.sessionId });
+            return { outcome: 'rejected', reason: rejectionReason(cause) };
+        }
+        log?.('discord_model_select_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+}
+/**
+ * The /model surface over the session controller: the composed per-session
+ * directory and the guarded selection mutation — the shapes model-control
+ * reasons about.
+ */
+export function createModelPort(dsh, options = {}) {
+    return {
+        models: sessionId => sessionModels(dsh, { sessionId }, options),
+        selectModel: request => selectSessionModel(dsh, request, options),
+    };
+}

package/lib/features/adapter-status.d.ts

@@ -106,6 +106,19 @@ export interface ManagementChannelDeps {
 export declare function createAdapterManagementHandler(deps: ManagementChannelDeps): (endpoint: string, payload: unknown, signal: {
     aborted: boolean;
 } | undefined) => Promise<RpcAnswer>;
-/** Register the management channel; returns the connection service's disposer. */
-export declare function installAdapterStatusRpc(connection: ConnectionRpc, tracker: AdapterStatusTracker, deps?: ManagementChannelDeps): () => void;
+/** Narrow composition context: service accessor plus the plugin's effect scope. */
+export interface HostChannelContext {
+    get(name: string): unknown;
+    effect(execute: () => unknown, label?: string): unknown;
+}
+/**
+ * Register the management channel on the webServer through the plugin's own
+ * context effect. The 0.1.6 host's `connection.rpc.handle` mounts through
+ * the connection service's OWN inject scope — an external plugin's call is
+ * rejected ("cannot get property webServer without inject") and a runtime
+ * ctx.inject wrapper never fires on an already-started plugin, so the
+ * sanctioned shape is: our prefix route, the connection service's fence
+ * method, and the channel envelope replicated verbatim.
+ */
+export declare function installAdapterStatusRpc(ctx: HostChannelContext, tracker: AdapterStatusTracker, deps?: ManagementChannelDeps): () => void;
 export {};