@addozhang/dsh-discord 0.6.2-rc.1 → 0.6.4-rc.1

package/README.md

@@ -23,6 +23,7 @@ No extra process: the adapter is a DSH plugin that mounts straight onto your `ds
 - **Approvals & questions** — DSH asks become buttons, select menus, and a free-text modal. Ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
 - **Session control** — `/steer`, `/stop`, and `/queue list|remove` with turn-ownership checks; `/project bind|list|info` and `/session resume` for guild↔workspace binding and history; `/guild forget` for operator cleanup.
 - **Model selection** — `/model show` reads the session's live model directory; `/model select` walks an interactive provider → model → reasoning cascade, or applies a typed `provider/model` directly. Open to any authorized member by default; restrictable to Host operators.
+- **Adapter status** — `/info` shows the adapter version, connection state, and project links (feedback, docs). Works in any channel.
 - **Permission switching** — `/permission show` / `set` read and switch the session's permission preset (bundled sandbox + approval tiers) through the Host's own `/permission` command path, inheriting its journal audit pair; `danger-full-access` requires a button confirmation.
 - **Settings card, bilingual out of the box** — token onboarding and connect/disconnect (stored in the Host credential service, never in settings or logs), guild allowlist, auto-archive, and language. Every Discord-visible string ships in Chinese and English; the bot follows the DSH language preference or a pinned choice.
 - **Hardened by design** — deny-first authorization inside an explicit guild allowlist. Mentions are suppressed twice: `allowed_mentions` on every request, plus byte-level neutralization of the wire body. DSH submission is at-most-once with unknown-preserving reconciliation — an ambiguous delivery is never blindly resent. Bindings survive restarts, and the READY sweep rebuilds deleted category/control channels while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
@@ -121,7 +122,8 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/project bind` | any channel | bind the guild to a workspace (admin; provisions the home channel) |
 | `/project list` / `info` | any channel | list workspaces / inspect this channel's binding |
 | `/queue list`, `/queue remove` | session thread | inspect and trim the pending queue |
-| `/steer`, `/stop` | session thread | steer or cancel the running turn (owner only) |
+| `/steer`, `/stop` | session thread | steer or cancel the running turn — any member of the thread may act on the current turn (the thread is a deliberately shared surface: single-user and small-team deployments; approvals/questions stay stricter — asker or thread owner only) |
+| `/info` | any channel | show the adapter version, connection state, and project links |
 | `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
 | `/session resume` | project channel | pick one of this workspace's past sessions (autocomplete: title and age, newest first) and resume it into a new thread of this channel; blank, already-bound, subagent, and archived sessions are never offered. The thread renders the session's history — answers and tool summaries plus the user's inputs as quoted echo lines (plugin/system injections are never echoed). After an adapter restart, threads catch up only what they missed: a persisted render watermark suppresses already-delivered history, and bound sessions re-subscribe on reconnect so turns prompted from the web UI still land in their thread |
 | `/guild forget` | any channel | operator-only removal of adapter records |
@@ -148,7 +150,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 729 tests incl. gateway/REST twin E2E
+pnpm test          # 782 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/README.zh.md

@@ -23,6 +23,7 @@
 - **审批与提问** — DSH 的 ask 渲染为按钮、下拉菜单与自由文本弹窗。所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
 - **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 与 `/session resume` 管理 Guild↔工作区绑定与历史会话；`/guild forget` 供操作员清理。
 - **模型切换** — `/model show` 读取会话的实时模型目录；`/model select` 走交互式 provider → 模型 → 推理强度级联，也可直接填写 `provider/model` 应用。默认对所有授权成员开放，可收紧为仅 Host 操作员。
+- **适配器状态** — `/info` 显示适配器版本、连接状态与项目链接（反馈/文档）。任意频道可用。
 - **权限切换** — `/permission show` / `set` 读写会话权限预设（沙箱 + 审批捆绑档位），走宿主自己的 `/permission` 命令路径，journal 自动记审计；`danger-full-access` 需按钮二次确认。
 - **设置卡片，开箱双语** — Token 引导与连接/断开（存入 Host 凭据服务，绝不写入设置或日志）、服务器白名单、自动归档与语言。所有 Discord 可见文案提供中英双语；Bot 默认跟随 DSH 语言偏好，也可从卡片固定。
 - **安全设计** — 显式服务器白名单内的 deny-first 授权。提及抑制双保险：每条请求携带 `allowed_mentions`，外加 wire body 的字节级提及中和。DSH 提交至多一次，并做保留 unknown 的对账——结果不明的投递绝不盲目重发。绑定重启后持久；READY 扫描会重建被删除的 category/控制频道，而把被删除的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
@@ -121,7 +122,8 @@ dsh-discord:
 | `/project bind` | 任意频道 | 将 Guild 绑定到工作区（管理员；会创建主频道） |
 | `/project list` / `info` | 任意频道 | 列出工作区 / 查看当前频道绑定 |
 | `/queue list`, `/queue remove` | 会话线程 | 查看与移除待处理队列 |
-| `/steer`, `/stop` | 会话线程 | 插话或取消运行中的 Turn（仅属主） |
+| `/steer`, `/stop` | 会话线程 | 插话或取消运行中的 Turn——线程内任意成员可操作当前 Turn（有意为之的共享驾驶舱模型，面向单人与小团队场景；审批/提问保持更严的提问人-or-线程主人规则） |
+| `/info` | 任意频道 | 显示适配器版本、连接状态与项目链接 |
 | `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
 | `/session resume` | 项目频道 | 自动补全选择本工作区的历史会话（显示标题与时间，最新优先），恢复为当前频道的新线程；空白、已挂线程、subagent、已归档的会话不会出现。线程会渲染会话历史——回答与工具摘要之外，用户输入以引用行回显（插件/系统注入永不回显）。适配器重启后线程只补齐错过部分：持久化的渲染水位抑制已投递过的历史，已绑定会话在重连时自动重订阅，因此从 web UI 发起的回合也会落进对应线程 |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
@@ -149,7 +151,7 @@ dsh-discord:
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 729 tests incl. gateway/REST twin E2E
+pnpm test          # 782 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/lib/client/DiscordSettingsCard.d.ts

@@ -3,4 +3,7 @@ import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-cli
 import type { DiscordCardFace } from './card-controller.js';
 /** Props the runtime binds for the Discord settings card. */
 export type DiscordSettingsCardProps = PropsRuntime<"settings.section"> & PropsLocale<'dsh-discord'> & InjectFace<DiscordCardFace>;
+/** Scoped stylesheet, injected once per card mount. Neutral translucent
+ * tones keep the controls readable on both the Host's dark and light themes. */
+export declare const CARD_CSS = "\n[data-dsh-discord-card] { display: flex; flex-direction: column; gap: 24px; padding: 4px 2px 0; }\n[data-dsh-discord-card-head] { display: flex; flex-direction: column; gap: 2px; text-align: left; }\n[data-dsh-discord-card-title] { font-size: 14px; font-weight: 600; display: inline-flex; align-items: center; gap: 8px; }\n[data-dsh-discord-card-title] svg { opacity: .85; }\n[data-dsh-discord-card-description] { font-size: 12px; opacity: .55; }\n[data-dsh-discord-card] button[aria-expanded] { all: unset; cursor: pointer; display: block; width: 100%; box-sizing: border-box; }\n[data-dsh-discord-card] button[aria-expanded]:focus-visible { outline: 2px solid rgba(88, 101, 242, .8); border-radius: 8px; }\n[data-dsh-discord-badge] { display: inline-block; font-size: 11px; line-height: 18px; padding: 0 8px; border-radius: 999px; }\n[data-dsh-discord-badge=\"unsaved\"] { background: rgba(250, 204, 21, .16); color: #facc15; }\n[data-dsh-discord-status] { display: flex; align-items: center; gap: 8px; font-size: 13px; }\n[data-dsh-discord-status-dot] { width: 10px; height: 10px; border-radius: 50%; flex: none; box-shadow: 0 0 6px currentColor; }\n[data-dsh-discord-field] { display: flex; flex-direction: column; gap: 6px; }\n[data-dsh-discord-field-help] + [data-dsh-discord-field], [data-dsh-discord-token] { margin-top: 8px; }\n[data-dsh-discord-field-head] { display: flex; align-items: center; gap: 8px; }\n[data-dsh-discord-field-head] label { font-size: 13px; font-weight: 500; }\n[data-dsh-discord-badges] { display: inline-flex; align-items: center; gap: 6px; margin-left: auto; }\n[data-dsh-discord-badge=\"overridden\"] { background: rgba(250, 204, 21, .16); color: #facc15; }\n[data-dsh-discord-field-head] button { all: unset; cursor: pointer; font-size: 12px; padding: 1px 8px; border-radius: 6px; background: rgba(127, 127, 127, .18); }\n[data-dsh-discord-field-head] button:hover { background: rgba(127, 127, 127, .3); }\n[data-dsh-discord-field] textarea, [data-dsh-discord-field] select {\n  width: 100%; box-sizing: border-box; color: inherit; font: inherit; font-size: 13px;\n  background: rgba(127, 127, 127, .12); border: 1px solid rgba(127, 127, 127, .28);\n  border-radius: 8px; padding: 8px 10px; resize: vertical;\n}\n[data-dsh-discord-field] textarea:focus-visible, [data-dsh-discord-field] select:focus-visible {\n  outline: none; border-color: rgba(88, 101, 242, .9);\n}\n[data-dsh-discord-field] textarea[aria-invalid=\"true\"], [data-dsh-discord-field] select[aria-invalid=\"true\"] {\n  border-color: rgba(242, 63, 67, .8);\n}\n[data-dsh-discord-field-note] { margin: 0; font-size: 12px; opacity: .55; }\n[data-dsh-discord-field-note=\"invalid\"] { opacity: 1; color: #f23f43; }\n[data-dsh-discord-field-help] { margin: -2px 0 0; font-size: 12px; opacity: .55; line-height: 1.6; }\n[data-dsh-discord-disconnect] { all: unset; cursor: pointer; margin-left: auto; font-size: 12px; padding: 2px 10px; border-radius: 6px; background: rgba(127, 127, 127, .18); }\n[data-dsh-discord-disconnect]:hover { background: rgba(242, 63, 67, .18); color: #f23f43; }\n[data-dsh-discord-token] { display: flex; flex-direction: column; gap: 8px; padding: 14px; border: 1px solid rgba(127, 127, 127, .28); border-radius: 10px; }\n[data-dsh-discord-token-row] { display: flex; gap: 10px; }\n[data-dsh-discord-token-row] input {\n  flex: 1; min-width: 0; box-sizing: border-box; color: inherit; font: inherit; font-size: 13px;\n  background: rgba(127, 127, 127, .12); border: 1px solid rgba(127, 127, 127, .28); border-radius: 8px; padding: 8px 10px;\n}\n[data-dsh-discord-token-row] input:focus-visible { outline: none; border-color: rgba(88, 101, 242, .9); }\n[data-dsh-discord-token-row] button { all: unset; cursor: pointer; font-size: 13px; padding: 7px 16px; border-radius: 8px; background: rgba(88, 101, 242, .9); color: #fff; white-space: nowrap; }\n[data-dsh-discord-token-row] button:disabled { opacity: .45; cursor: default; }\n[data-dsh-discord-token-error] { margin: 0; font-size: 12px; color: #f23f43; }\n[data-dsh-discord-card-footer] { display: flex; justify-content: flex-end; gap: 10px; margin-top: 4px; }\n[data-dsh-discord-card-footer] button { all: unset; cursor: pointer; font-size: 13px; padding: 6px 16px; border-radius: 8px; }\n[data-dsh-discord-card-footer] button[type=\"button\"]:first-child { background: rgba(127, 127, 127, .18); }\n[data-dsh-discord-card-footer] button:not(:disabled) { background: rgba(88, 101, 242, .9); color: #fff; }\n[data-dsh-discord-card-footer] button[type=\"button\"]:first-child:not(:disabled) { background: rgba(127, 127, 127, .18); color: inherit; }\n[data-dsh-discord-card-footer] button:disabled { opacity: .4; cursor: default; }\n[data-dsh-discord-card-footer] button:not(:disabled):hover { filter: brightness(1.12); }\n";
 export declare function DiscordSettingsCard(props: DiscordSettingsCardProps): import("react/jsx-runtime").JSX.Element | null;

package/lib/client/card-form.d.ts

@@ -88,6 +88,8 @@ export declare class DiscordCardForm {
     private saving;
     private failed;
     private status;
+    /** The one bound store every face shares (lazily created). */
+    private bound;
     constructor(scope: ConfigForm<DiscordSettings>);
     /**
      * Publish the Host's sanitized status view. Edits, saves, and failures

package/lib/client.js

@@ -870,6 +870,8 @@ var DiscordCardForm = class {
   saving = false;
   failed = false;
   status = void 0;
+  /** The one bound store every face shares (lazily created). */
+  bound;
   /**
    * Publish the Host's sanitized status view. Edits, saves, and failures
    * never touch it — connection state is the Host's report, not form state.
@@ -880,11 +882,13 @@ var DiscordCardForm = class {
   }
   /** Publish the card state the renderer reads through its bound selector. */
   bind() {
-    const store = createLocalSnapshotStore(this.project());
-    this.listeners.add(() => {
-      store.set(this.project());
-    });
-    return store;
+    if (this.bound === void 0) {
+      this.bound = createLocalSnapshotStore(this.project());
+      this.listeners.add(() => {
+        this.bound?.set(this.project());
+      });
+    }
+    return this.bound;
   }
   /** Build the edit, reset, save, and discard actions bound to this form. */
   actions() {
@@ -1004,11 +1008,17 @@ var DiscordCardForm = class {
     this.saving = true;
     this.failed = false;
     this.publish();
+    const plannedDrafts = /* @__PURE__ */ new Map();
+    for (const item of plan) plannedDrafts.set(item.field, this.staged.get(item.field));
     let landed = true;
     for (const write of writes) {
       landed = await write().catch(() => false) && landed;
     }
-    if (landed) this.staged.clear();
+    if (landed) {
+      for (const [field, snapshot] of plannedDrafts) {
+        if (this.staged.get(field) === snapshot) this.staged.delete(field);
+      }
+    }
     this.saving = false;
     this.failed = !landed;
     this.publish();
@@ -1246,8 +1256,8 @@ var CARD_CSS = `
 [data-dsh-discord-card-title] { font-size: 14px; font-weight: 600; display: inline-flex; align-items: center; gap: 8px; }
 [data-dsh-discord-card-title] svg { opacity: .85; }
 [data-dsh-discord-card-description] { font-size: 12px; opacity: .55; }
-button[aria-expanded] { all: unset; cursor: pointer; display: block; width: 100%; box-sizing: border-box; }
-button[aria-expanded]:focus-visible { outline: 2px solid rgba(88, 101, 242, .8); border-radius: 8px; }
+[data-dsh-discord-card] button[aria-expanded] { all: unset; cursor: pointer; display: block; width: 100%; box-sizing: border-box; }
+[data-dsh-discord-card] button[aria-expanded]:focus-visible { outline: 2px solid rgba(88, 101, 242, .8); border-radius: 8px; }
 [data-dsh-discord-badge] { display: inline-block; font-size: 11px; line-height: 18px; padding: 0 8px; border-radius: 999px; }
 [data-dsh-discord-badge="unsaved"] { background: rgba(250, 204, 21, .16); color: #facc15; }
 [data-dsh-discord-status] { display: flex; align-items: center; gap: 8px; font-size: 13px; }
@@ -1342,7 +1352,8 @@ function TokenSetup(props) {
       /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("button", { type: "button", disabled: connecting || !props.tokenConfigured && token.trim() === "", onClick: submit, children: connecting ? t("discordTokenConnecting") : t("discordTokenConnect") })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { "data-dsh-discord-field-help": "", children: props.tokenConfigured ? t("discordTokenReconnectHint") : t("discordTokenHelp") }),
-    error !== "" && /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { "data-dsh-discord-token-error": "", children: error })
+    error !== "" && /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { "data-dsh-discord-token-error": "", children: error }),
+    /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("p", { "data-dsh-discord-card-footer-link": "", style: { margin: "8px 0 0", fontSize: 12, opacity: 0.6 }, children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("a", { href: "https://github.com/addozhang/dsh-discord", target: "_blank", rel: "noopener noreferrer", children: "\u2B50 Feedback & docs" }) })
   ] });
 }
 function DiscordSettingsCard(props) {

package/lib/credential.d.ts

@@ -1,4 +1,9 @@
-export declare const DISCORD_BOT_TOKEN_REF: import("@deepseek-ai/dsh-credentials").CredentialRef;
+/** Branded ref, inlined from @deepseek-ai/dsh-credentials (runtime value
+ * is the plain string — the brand is compile-time only; see domain.ts). */
+export type DiscordCredentialRef = string & {
+    readonly __brand: 'DiscordCredentialRef';
+};
+export declare const DISCORD_BOT_TOKEN_REF: DiscordCredentialRef;
 export interface DiscordCredentialProvider {
     describe(ref: typeof DISCORD_BOT_TOKEN_REF): Promise<{
         configured: boolean;

package/lib/credential.js

@@ -1,4 +1,8 @@
-import { credentialRef } from '@deepseek-ai/dsh-credentials';
+function credentialRef(value) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(value))
+        throw new TypeError(`credential ref "${value}" must be an uppercase identifier`);
+    return value;
+}
 export const DISCORD_BOT_TOKEN_REF = credentialRef('DSH_DISCORD_BOT_TOKEN');
 export async function describeDiscordCredential(provider) {
     const result = await provider.describe(DISCORD_BOT_TOKEN_REF);

package/lib/discord/commands.d.ts

@@ -42,9 +42,14 @@ export declare const MILESTONE_ONE_COMMANDS: readonly AdapterCommand[];
 /**
  * Build the bulk-overwrite registration payload for
  * `PUT /applications/{application.id}/commands`.
- * `default_member_permissions: '0'` keeps every command visible: the
- * adapter's own deny-first RBAC authorizes at interaction time, because
- * Discord roles cannot express Workspace-administrator or Host-operator
- * authority.
+ * `default_member_permissions` is deliberately OMITTED: `'0'` is Discord's
+ * "disabled for everyone except server admins" sentinel, which hid the
+ * commands from ordinary members entirely — the opposite of the adapter's
+ * model, where every command is visible to the guild and the deny-first
+ * RBAC gate authorizes at interaction time (Discord roles cannot express
+ * Workspace-administrator or Host-operator authority anyway). Omitted
+ * means @everyone may invoke, subject to the guild's own role overrides.
+ * Wire change: verify once on a real machine with a plain member account
+ * (the digital twin does not model permission gating).
  */
 export declare function buildCommandRegistrations(): Array<Record<string, unknown>>;

package/lib/discord/commands.js

@@ -27,6 +27,7 @@ export const MILESTONE_ONE_COMMANDS = [
         { name: 'list' },
         { name: 'remove', options: [{ name: 'item', required: true }] },
     ]),
+    leaf('info', 'Show the adapter version, connection state, and project links'),
     leaf('steer', 'Steer the running turn of this thread', [{ name: 'prompt', required: true }]),
     leaf('stop', 'Cancel the running turn of this thread'),
     grouped('model', 'Show or select the session model', [
@@ -68,10 +69,15 @@ function argumentToWire(option) {
 /**
  * Build the bulk-overwrite registration payload for
  * `PUT /applications/{application.id}/commands`.
- * `default_member_permissions: '0'` keeps every command visible: the
- * adapter's own deny-first RBAC authorizes at interaction time, because
- * Discord roles cannot express Workspace-administrator or Host-operator
- * authority.
+ * `default_member_permissions` is deliberately OMITTED: `'0'` is Discord's
+ * "disabled for everyone except server admins" sentinel, which hid the
+ * commands from ordinary members entirely — the opposite of the adapter's
+ * model, where every command is visible to the guild and the deny-first
+ * RBAC gate authorizes at interaction time (Discord roles cannot express
+ * Workspace-administrator or Host-operator authority anyway). Omitted
+ * means @everyone may invoke, subject to the guild's own role overrides.
+ * Wire change: verify once on a real machine with a plain member account
+ * (the digital twin does not model permission gating).
  */
 export function buildCommandRegistrations() {
     return MILESTONE_ONE_COMMANDS.map((command) => {
@@ -88,7 +94,6 @@ export function buildCommandRegistrations() {
             name: command.name,
             description: command.description,
             contexts: [DISCORD_GUILD_CONTEXT],
-            default_member_permissions: '0',
             ...(options === undefined || options.length === 0 ? {} : { options }),
         };
     });

package/lib/discord/rest.d.ts

@@ -2,9 +2,14 @@
  * The typed Discord REST adapter. Every request resolves to exactly one of
  * three outcomes — `completed`, `rejected`, or `unknown` — because cross-system
  * delivery is never provably once: a refused request (4xx, exhausted 429) is
- * definitive, while an unobservable outcome (network failure, abort,
- * exhausted 5xx) may or may not have been applied and must be reconciled,
- * never blindly retried by callers.
+ * definitive, while an unobservable outcome (network failure, abort, 5xx)
+ * may or may not have been applied and must be reconciled, never blindly
+ * retried by callers. That holds inside the adapter too: transient failures
+ * are auto-retried only for idempotent methods (GET/PUT/DELETE/PATCH); a
+ * POST that hits 5xx or the network fails returns `unknown` on the first
+ * failure — the retry decision belongs to the caller's nonce
+ * reconciliation, because a re-sent POST whose first attempt landed would
+ * double-deliver with no error to show for it.
  */
 export type RestMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
 /** The untyped wire face injected for testability (fetch-shaped). */
@@ -46,6 +51,14 @@ export interface RestClientOptions {
     backoffBaseMs?: number;
     /** Cap for any single wait, so a hostile Retry-After cannot stall the adapter. */
     maxDelayMs?: number;
+    /**
+     * Ack budget applied automatically to `/interactions/` callback paths:
+     * Discord grants one callback per interaction inside a 3-second deadline,
+     * so a request parked behind a Retry-After sleep (or a 5xx backoff)
+     * would deliver an ack that can no longer matter — the budget aborts it
+     * to unknown early instead. 0 disables the budget.
+     */
+    interactionAckBudgetMs?: number;
 }
 export declare function createRestClient(config: RestClientConfig, options?: RestClientOptions, fetchLike?: FetchLike): {
     request<T>(method: RestMethod, path: string, body?: unknown, init?: {

package/lib/discord/rest.js

@@ -2,18 +2,39 @@
  * The typed Discord REST adapter. Every request resolves to exactly one of
  * three outcomes — `completed`, `rejected`, or `unknown` — because cross-system
  * delivery is never provably once: a refused request (4xx, exhausted 429) is
- * definitive, while an unobservable outcome (network failure, abort,
- * exhausted 5xx) may or may not have been applied and must be reconciled,
- * never blindly retried by callers.
+ * definitive, while an unobservable outcome (network failure, abort, 5xx)
+ * may or may not have been applied and must be reconciled, never blindly
+ * retried by callers. That holds inside the adapter too: transient failures
+ * are auto-retried only for idempotent methods (GET/PUT/DELETE/PATCH); a
+ * POST that hits 5xx or the network fails returns `unknown` on the first
+ * failure — the retry decision belongs to the caller's nonce
+ * reconciliation, because a re-sent POST whose first attempt landed would
+ * double-deliver with no error to show for it.
  */
 import { randomUUID } from 'node:crypto';
 const DEFAULT_API_BASE = 'https://discord.com/api/v10';
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_BACKOFF_BASE_MS = 1_000;
 const DEFAULT_MAX_DELAY_MS = 30_000;
+/** Discord's interaction ack deadline is 3s; leave margin for the call itself. */
+const DEFAULT_INTERACTION_ACK_BUDGET_MS = 2_500;
 const sleep = (ms) => {
     return new Promise(resolve => { setTimeout(resolve, ms); });
 };
+/** sleep() that also wakes when the signal aborts, so a deadline can cut a pending Retry-After wait. */
+function sleepAbortable(ms, signal) {
+    if (signal === undefined)
+        return sleep(ms);
+    return new Promise(resolve => {
+        const done = () => {
+            signal.removeEventListener('abort', done);
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener('abort', done, { once: true });
+    });
+}
 function parseDelayMs(response, fallbackMs, capMs) {
     const header = response.headers.get('retry-after');
     const seconds = header === null ? Number.NaN : Number.parseFloat(header);
@@ -37,6 +58,7 @@ export function createRestClient(config, options = {}, fetchLike) {
     const maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
     const backoffBaseMs = options.backoffBaseMs ?? DEFAULT_BACKOFF_BASE_MS;
     const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+    const interactionAckBudgetMs = options.interactionAckBudgetMs ?? DEFAULT_INTERACTION_ACK_BUDGET_MS;
     const doFetch = fetchLike ?? (async (request) => {
         const init = { method: request.method, headers: request.headers };
         if (request.body !== undefined)
@@ -77,8 +99,17 @@ export function createRestClient(config, options = {}, fetchLike) {
         }
     }
     async function request(method, path, body, init) {
+        // Interaction callbacks are deadline-bound: fold the ack budget into
+        // the effective signal so the retry loop's checks, the in-flight
+        // fetch, AND the Retry-After sleeps all honor it.
+        let signal = init?.signal;
+        if (interactionAckBudgetMs > 0 && path.startsWith('/interactions/')) {
+            signal = signal === undefined
+                ? AbortSignal.timeout(interactionAckBudgetMs)
+                : AbortSignal.any([signal, AbortSignal.timeout(interactionAckBudgetMs)]);
+        }
         for (let attemptNo = 0; attemptNo <= maxRetries; attemptNo += 1) {
-            if (init?.signal?.aborted === true) {
+            if (signal?.aborted === true) {
                 return { outcome: 'unknown', reason: 'aborted' };
             }
             const fetchRequest = {
@@ -90,7 +121,7 @@ export function createRestClient(config, options = {}, fetchLike) {
                     ...(body === undefined ? {} : { 'content-type': 'application/json' }),
                 },
                 ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-                ...(init?.signal === undefined ? {} : { signal: init.signal }),
+                ...(signal === undefined ? {} : { signal }),
             };
             const outcome = await attempt(fetchRequest);
             if ('retry' in outcome) {
@@ -101,13 +132,21 @@ export function createRestClient(config, options = {}, fetchLike) {
                     if (isFinalAttempt) {
                         return { outcome: 'rejected', status: 429, error: { code: 'rate-limited', message: 'rate limit retries exhausted' } };
                     }
-                    await sleep(outcome.delayMs);
+                    await sleepAbortable(outcome.delayMs, signal);
                     continue;
                 }
+                // A 5xx or network failure may mean the request was already applied
+                // upstream. Auto-retrying a non-idempotent POST could then deliver
+                // the message twice and the retry's 200 would mask it — so POST
+                // surfaces unknown immediately and the caller's nonce reconciliation
+                // decides; only idempotent methods ride the bounded retry loop.
+                if (method !== 'GET' && method !== 'PUT' && method !== 'DELETE' && method !== 'PATCH') {
+                    return { outcome: 'unknown', reason: 'network-unreachable' };
+                }
                 if (isFinalAttempt) {
                     return { outcome: 'unknown', reason: 'network-unreachable' };
                 }
-                await sleep(Math.min(backoffBaseMs * 2 ** attemptNo, maxDelayMs));
+                await sleepAbortable(Math.min(backoffBaseMs * 2 ** attemptNo, maxDelayMs), signal);
                 continue;
             }
             return outcome;

package/lib/discord/thread-port.js

@@ -34,8 +34,12 @@ export function createRestThreadPort(rest, options = {}) {
             // `threads/active` route does not exist in the Discord API (archived
             // listing is the only channel-level one), so recovery would 404 forever.
             const listed = await rest.request('GET', `/guilds/${request.guildId}/threads/active`);
+            // An unobservable listing is NOT a definitive absence (review A4):
+            // conflating the two lets crash-window recovery conclude a thread
+            // that exists was never created. Only a completed listing that
+            // scanned past the source message proves 'not-found'.
             if (listed.outcome !== 'completed')
-                return { outcome: 'not-found' };
+                return { outcome: 'unknown' };
             const threads = Array.isArray(listed.body?.threads) ? listed.body.threads : [];
             for (const thread of threads.slice(0, MAX_THREADS_SCANNED)) {
                 const oldest = await rest.request('GET', `/channels/${thread.id}/messages?after=0&limit=1`);

package/lib/dsh/host-asks.js

@@ -109,7 +109,13 @@ export function installAskServicePatches(approval, questions, deps) {
             pending.dispose();
         void pending.promise.then(() => {
             deps.onWaitState?.(threadId, false);
-            void deps.askWiring.disableControl(approvalId);
+            void deps.askWiring.disableControl(approvalId).catch((cause) => {
+                deps.log('discord_ask_control_disable_failed', { key: approvalId, cause: String(cause) });
+            });
+        }).catch((cause) => {
+            // The ask itself has settled; a failing wait-state clear must not
+            // escape as an unhandled rejection.
+            deps.log('discord_ask_wait_clear_failed', { threadId, cause: String(cause) });
         });
         return pending.promise;
     };
@@ -142,7 +148,11 @@ export function installAskServicePatches(approval, questions, deps) {
                 pending.dispose();
             void pending.promise.then(() => {
                 deps.onWaitState?.(threadId, false);
-                void deps.askWiring.disableControl(rpcId);
+                void deps.askWiring.disableControl(rpcId).catch((cause) => {
+                    deps.log('discord_ask_control_disable_failed', { key: rpcId, cause: String(cause) });
+                });
+            }).catch((cause) => {
+                deps.log('discord_ask_wait_clear_failed', { threadId, cause: String(cause) });
             });
             return pending.promise;
         };

package/lib/dsh/host-events.d.ts

@@ -43,6 +43,14 @@ export interface TrackSeedOptions {
 export interface HostEventRouterOptions {
     log?: (event: string, detail?: unknown) => void;
 }
+interface FrameQueue {
+    push(frame: unknown): void;
+    close(): void;
+}
+/** Build the push-side of the single consumer queue. */
+export declare function createFrameQueue(): FrameQueue & {
+    iterate(signal: AbortSignal): AsyncIterable<unknown>;
+};
 /**
  * The fan-in router. `track(sessionId)` is idempotent and safe to call from
  * every session-acquisition site (create, adopt, resume, prompt); each
@@ -51,4 +59,7 @@ export interface HostEventRouterOptions {
 export declare function createHostEventRouter(services: HostSessionFollowFace, options?: HostEventRouterOptions): {
     track(sessionId: string, seed?: TrackSeedOptions): void;
     stream(signal: AbortSignal): AsyncIterable<unknown>;
+    /** Abort every tracked follow loop, cancel pending re-arms, stop the router. */
+    dispose(): void;
 };
+export {};

package/lib/dsh/host-events.js

@@ -18,7 +18,7 @@
  *   ask-wiring migration wires separately.
  */
 /** Build the push-side of the single consumer queue. */
-function createFrameQueue() {
+export function createFrameQueue() {
     const buffered = [];
     let notify;
     let closed = false;
@@ -54,12 +54,18 @@ function createFrameQueue() {
                             if (closed)
                                 return;
                             await new Promise(resolve => {
-                                notify = resolve;
                                 const abort = () => {
                                     notify = undefined;
                                     resolve();
                                 };
                                 signal.addEventListener('abort', abort, { once: true });
+                                notify = () => {
+                                    // The wake path must drop its abort listener: a streaming
+                                    // session parks here per drain, and a leaked listener per
+                                    // park accumulates into MaxListenersExceededWarning.
+                                    signal.removeEventListener('abort', abort);
+                                    resolve();
+                                };
                             });
                         }
                     }
@@ -112,8 +118,11 @@ export function createHostEventRouter(services, options = {}) {
     const watermark = new Map();
     /** Sessions whose NEXT opening snapshot is swallowed whole (legacy bindings). */
     const suppressOnce = new Set();
+    /** Pending re-arm timers: disposed routers must stop resubscribing. */
+    const rearmTimers = new Set();
     let consumer;
     let rootSignal;
+    let disposed = false;
     const startLoop = (sessionId, attempt = 0) => {
         const per = new AbortController();
         tracked.set(sessionId, per);
@@ -244,12 +253,16 @@ export function createHostEventRouter(services, options = {}) {
                 // process restart replays the journal. Re-arm with backoff.
                 if (!per.signal.aborted) {
                     const delayMs = Math.min(30_000, 1_000 * 2 ** attempt);
-                    setTimeout(() => {
-                        if (!per.signal.aborted && !tracked.has(sessionId)) {
-                            log?.('discord_host_follow_resubscribed', { sessionId, delayMs });
-                            startLoop(sessionId, attempt + 1);
-                        }
+                    const timer = setTimeout(() => {
+                        rearmTimers.delete(timer);
+                        if (disposed || per.signal.aborted || tracked.has(sessionId))
+                            return;
+                        log?.('discord_host_follow_resubscribed', { sessionId, delayMs });
+                        startLoop(sessionId, attempt + 1);
                     }, delayMs);
+                    // A parked re-arm must never pin the host's event loop open.
+                    timer.unref();
+                    rearmTimers.add(timer);
                 }
             }
         })();
@@ -293,7 +306,7 @@ export function createHostEventRouter(services, options = {}) {
         track(sessionId, seed) {
             if (sessionId === '' || tracked.has(sessionId))
                 return;
-            if (rootSignal?.aborted)
+            if (disposed || rootSignal?.aborted)
                 return;
             if (seed !== undefined) {
                 // Seed BEFORE the loop opens: the opening snapshot races the very
@@ -321,5 +334,20 @@ export function createHostEventRouter(services, options = {}) {
             startControlLoop(signal);
             return queue.iterate(signal);
         },
+        dispose() {
+            // Plugin teardown: the per-session follow loops run on their own
+            // controllers (the consumer signal only reaches the control loop),
+            // so nothing else stops them — without this, disposal leaves zombie
+            // subscriptions and a re-arm chain that resubscribes forever.
+            disposed = true;
+            rootSignal = undefined;
+            for (const [, per] of [...tracked.entries()])
+                per.abort();
+            tracked.clear();
+            for (const timer of rearmTimers)
+                clearTimeout(timer);
+            rearmTimers.clear();
+            consumer?.close();
+        },
     };
 }

package/lib/dsh/host-face.js

@@ -489,8 +489,13 @@ async function readSessionSelection(dsh, sessionId, options) {
         const dispose = observation?.[Symbol.asyncDispose]
             ?? observation?.dispose;
         if (typeof dispose === 'function') {
+            // The asyncDispose convention returns a promise: a rejection there
+            // must be caught, or it escapes as an unhandled rejection that kills
+            // the host process.
             try {
-                void dispose.call(observation);
+                Promise.resolve(dispose.call(observation)).catch((cause) => {
+                    log?.('discord_session_selection_dispose_threw', { cause: String(cause) });
+                });
             }
             catch (cause) {
                 log?.('discord_session_selection_dispose_threw', { cause: String(cause) });
@@ -656,8 +661,12 @@ async function readSessionPermission(dsh, sessionId, options) {
         const dispose = observation?.[Symbol.asyncDispose]
             ?? observation?.dispose;
         if (typeof dispose === 'function') {
+            // See readSessionSelection: the disposal promise's rejection is
+            // caught, never unhandled.
             try {
-                void dispose.call(observation);
+                Promise.resolve(dispose.call(observation)).catch((cause) => {
+                    log?.('discord_session_permission_dispose_threw', { cause: String(cause) });
+                });
             }
             catch (cause) {
                 log?.('discord_session_permission_dispose_threw', { cause: String(cause) });

package/lib/features/interaction-router.d.ts

@@ -60,6 +60,10 @@ export interface InteractionRouterDeps {
     } | undefined>;
     /** Delete every adapter-owned record for one guild (DSH untouched). */
     forgetGuild: (guildId: string) => Promise<void>;
+    /** The adapter's own package version (from package.json at load). */
+    adapterVersion: () => string;
+    /** One-word connection condition for /info. */
+    adapterStatus: () => string;
     /** Ephemeral failure/guidance followup on a component interaction. */
     componentFollowUp: (interactionId: string, interactionToken: string, content: string) => Promise<void>;
     /** Retire a rendered control (remove its components on the source message). */
@@ -76,7 +80,7 @@ export interface InteractionRouterDeps {
         userId: string;
         threadId: string;
         text: string;
-    }) => QuestionInteractionOutcome;
+    }) => Promise<QuestionInteractionOutcome>;
     rest: () => Promise<SharedRestClient | undefined>;
     /**
      * Delete one channel→Workspace binding row (bind precheck: a bound