@aiwayds/dsh-tui-pi 2.0.0 → 2.0.2

package/README.md

@@ -40,6 +40,8 @@ dsh plugin --profile tui add @aiwayds/dsh-dcp                 # optional
 dsh --profile tui          # launch (or: dsh-tui-pi)
 ```
 
+Legacy `session_projcache` records (missing `identity.isSeeded`/`identity.inheritedEventCount`, written before dsh 0.1.2-alpha.4) are migrated at the profile layer: the bundle patch replaces the stock `session-projection-cache` row with a wrapper (`@aiwayds/dsh-tui-pi/projcache`) that backfills the records while its module loads — strictly before the stock plugin could open the domain and crash the boot — so every `dsh --profile tui` start is covered, launcher or not. Migration is idempotent, backs up every rewritten file next to the original, and never blocks startup. The `dsh-tui-pi` launcher additionally runs the same migration as a CLI preflight before `exec dsh`.
+
 Everything that used to need manual patching — the canvas background, the `@deepseek-ai` module closure, the compaction backend — now happens automatically. Upgrade an existing profile after a release:
 
 ```sh

package/bin/dsh-tui-pi

@@ -2,4 +2,6 @@
 # Convenience launcher: boots the dsh `tui` profile that mounts @aiwayds/dsh-tui-pi.
 # Requires the dsh CLI on PATH and @aiwayds/dsh-tui-pi installed into that profile
 # (dsh plugin --profile tui add @aiwayds/dsh-tui-pi).
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$(readlink -f -- "$0" 2>/dev/null || echo "$0")")" && pwd)
+node "$SCRIPT_DIR/preflight-projcache.mjs" >/dev/null 2>&1 || true
 exec dsh --profile tui "$@"

package/bin/preflight-projcache.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/**
+ * Preflight migration for the dsh `session_projcache` storage domain — CLI
+ * shell around the shared core (lib/preflight-projcache.js, built from
+ * src/preflight-projcache.ts). The `dsh-tui-pi` launcher (bin/dsh-tui-pi)
+ * runs this before `exec dsh`. This is one of two mount points for the
+ * migration; the other is lib/projcache.js, the wrapper module the bundle
+ * patch mounts in place of the stock session-projection-cache row, so plain
+ * `dsh --profile tui` boots are covered without the launcher.
+ *
+ * Contract (unchanged since 2.0.1):
+ *   - scans <DSH_HOME||~/.dsh>/storages/session_projcache/sessions/session-*.json
+ *   - backfills identity.isSeeded:false / identity.inheritedEventCount:0
+ *   - records that already carry both fields are left byte-identical (no IO);
+ *   - every changed record is backed up next to the original, then rewritten
+ *     atomically (tmp file + rename);
+ *   - per-record problems warn on stderr and never abort the scan;
+ *   - ALWAYS exits 0: a preflight failure must never block startup.
+ */
+
+import fs from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { preflightProjcache, projcacheSessionsDir } from '../lib/preflight-projcache.js'
+
+function isMainEntry() {
+  try {
+    return Boolean(process.argv[1])
+      && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))
+  } catch {
+    return false
+  }
+}
+
+// Run the CLI shell only when executed directly — importing this module
+// must have no side effects.
+if (isMainEntry()) {
+  try {
+    const check = process.argv.includes('--check')
+    const { fixed } = preflightProjcache(projcacheSessionsDir(), { check })
+    if (check) process.stdout.write(`${fixed} session_projcache record(s) need migration\n`)
+  } catch (err) {
+    // Never block startup: a preflight failure is a warning, not an error.
+    process.stderr.write(`[preflight-projcache] skipped: ${err?.message ?? err}\n`)
+  }
+  process.exit(0)
+}

package/cordis.patch.yml

@@ -14,9 +14,36 @@
 # the bundle to be wired into the model-facing tool catalog. Without this
 # insert, the `ask_user_question` tool never registers with the model and
 # the user-questions seam has no visible surface in this profile.
+#
+# The stock session-projection-cache row is REPLACED (disable + wrapper), not
+# extended: the alpha.4 record schema fail-fasts at storage-open on records
+# written by 0.1.1-rc.2-era hosts (missing identity.isSeeded /
+# identity.inheritedEventCount), and the crash happens inside the stock
+# plugin's own Service.init — the loader collects it from the parallel
+# allSettled and tears down the whole boot before any later-initializing
+# plugin could repair the data. The wrapper entry below (tui-pi-projcache)
+# mounts @aiwayds/dsh-tui-pi/projcache, which backfills the legacy fields at
+# module-evaluation time — the one hook the loader reaches strictly before
+# Service.init — and otherwise re-exports the stock module unchanged.
+#
+# The `name` field on the disable patch is a guard, not an override: if a
+# future host renames or drops the row, the patch is skipped with a loader
+# warning instead of silently disabling an unrelated entry.
+
+- id: session-projection-cache
+  name: '@deepseek-ai/dsh-session-projection-cache'
+  disabled: true
 
 - insert:
     - id: tui-pi
       name: '@aiwayds/dsh-tui-pi'
     - id: tool-ask-user
       name: '@deepseek-ai/dsh-tool-ask-user'
+    # Config mirrors the stock row's values (the plugin's Config schema
+    # requires both fields); a later upstream retune of the base row does not
+    # propagate through a disabled entry, so revisit on host upgrades.
+    - id: tui-pi-projcache
+      name: '@aiwayds/dsh-tui-pi/projcache'
+      config:
+        writeEveryEvents: 200
+        writeIntervalMs: 5000

package/lib/model-sync.d.ts

@@ -0,0 +1,122 @@
+/**
+ * /model-sync (singular) — discover models for CUSTOM provider routes and
+ * merge them back into the llm-pi-ai settings section.
+ *
+ * A custom route is a hand-declared `llm-pi-ai.providers.<id>` profile that
+ * carries a `baseURL` and is NOT one of the built-in catalog routes
+ * (provider-catalog.ts): discovery against a catalog route would short-circuit
+ * back to the installed pi-ai catalog. This command interrogates
+ * each route's `GET ${baseURL}/models` through the official seam
+ * (`LlmRuntime.discoverModels`, registered for the `llm-pi-ai` namespace by
+ * dsh-llm-pi-ai with catalog short-circuit + stored-credential resolution),
+ * then merges the answer into the profile's `models` array.
+ *
+ * The merge is additive-only: existing entries are preserved verbatim (local
+ * overrides such as reasoningEfforts survive), discovered ids already present
+ * are skipped, new ids are appended with sanitized metadata. The write goes
+ * through `settings.mutate` at the revision read at execution time, with one
+ * retry after SettingsConflictError (the persistDefaultModel pattern in
+ * session.ts). Pure logic lives here as exported functions; src/index.ts only
+ * wires the command.
+ *
+ * @module dsh-tui-pi/model-sync
+ */
+import type { SettingsProvider } from '@deepseek-ai/dsh-settings';
+import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
+/**
+ * The services /model-sync needs, narrowed to the exact surface it touches so
+ * tests can supply fakes without a live tree.
+ */
+export interface ModelSyncDeps {
+    /** The settings provider (describe for revisions, mutate for the write). */
+    settings: Pick<SettingsProvider, 'describe' | 'mutate'>;
+    /** The LLM runtime whose discoverModels serves the `llm-pi-ai` namespace. */
+    llm: Pick<LlmRuntime, 'discoverModels'>;
+}
+/** One models entry as stored in a profile — passed through untouched. */
+type StoredModel = Record<string, unknown>;
+/**
+ * A custom route selected for sync: the dict key plus the endpoint facts
+ * discovery needs. `api` is optional — discovery defaults the protocol.
+ */
+export interface CustomProviderRoute {
+    id: string;
+    baseURL: string;
+    api?: string;
+}
+/**
+ * A sanitized discovered model — the writable shape of one endpoint row:
+ * always an id; name/capacities carried only when present and valid.
+ */
+export interface SanitizedModel {
+    id: string;
+    name?: string;
+    contextWindow?: number;
+    maxTokens?: number;
+}
+/** Outcome of merging one route's discovery into its stored models. */
+export interface ModelSyncMergeResult {
+    /**
+     * The merged models array to store: existing entries first in their stored
+     * order, newly discovered ids appended at the end in discovery order.
+     */
+    models: StoredModel[];
+    /** Discovered rows appended as new entries. */
+    added: number;
+    /** Existing entries preserved verbatim. */
+    kept: number;
+    /**
+     * Discovered rows dropped entirely: unusable id, or an id already covered
+     * by an existing entry (local state wins) or by an earlier row of this batch.
+     */
+    skipped: number;
+}
+/**
+ * Select the custom (hand-declared) routes worth syncing from a providers
+ * dict: profiles carrying a non-empty `baseURL` whose key is not a built-in
+ * catalog route — a catalog key would short-circuit discovery back to the
+ * installed catalog. Sorted by route key so the
+ * report order is stable regardless of document order.
+ */
+export declare function selectCustomProviders(providers: Record<string, unknown> | undefined): CustomProviderRoute[];
+/**
+ * Clean one discovered row into a writable models entry. The id is mandatory
+ * (blank/absent → undefined); name must be a non-blank string; capacities
+ * must be integers ≥ 1 — the llm-pi-ai schema rejects anything else at write
+ * time (`contextWindow >= 1`, integer step), and a field that fails stays
+ * behind rather than sinking the whole row (verified against the shipped
+ * schema: absent name/contextWindow/maxTokens validate fine).
+ */
+export declare function sanitizeDiscoveredModel(raw: unknown): SanitizedModel | undefined;
+/**
+ * Merge one route's discovery into its stored models — additive-only:
+ *
+ * - existing entries are the base and are preserved VERBATIM (local overrides
+ *   like reasoningEfforts/input/compat survive; nothing is overwritten or
+ *   deleted);
+ * - discovered rows join by id: an id already present (or repeated within the
+ *   batch) counts as skipped, local state wins;
+ * - new ids are appended with `sanitizeDiscoveredModel`'s cleaned fields;
+ * - the stored order is never touched: existing entries keep their positions
+ *   (id-less rows included) and new ids join at the end in discovery order.
+ */
+export declare function mergeModels(existing: ReadonlyArray<object>, discovered: ReadonlyArray<unknown>): ModelSyncMergeResult;
+/**
+ * Run one /model-sync round: select the target routes (the rawInput-named one,
+ * or every custom route), discover each endpoint's models, merge, and write
+ * back. One route's failure never aborts the rest — its line reports the
+ * reason instead. Agentless by design: nothing here touches a session.
+ *
+ * @returns the command result — per-provider `<id>: added N · kept M ·
+ *   skipped K` lines on success, `<id>: <reason>` for failed routes; `kind:
+ *   'error'` only for preconditions (missing namespace, unknown/non-custom
+ *   named route) or when EVERY route failed.
+ */
+export declare function runModelSync(deps: ModelSyncDeps, options?: {
+    rawInput?: string;
+    signal?: AbortSignal;
+}): Promise<{
+    kind: 'success' | 'error';
+    text: string;
+}>;
+export {};

package/lib/model-sync.js

@@ -0,0 +1,256 @@
+/**
+ * /model-sync (singular) — discover models for CUSTOM provider routes and
+ * merge them back into the llm-pi-ai settings section.
+ *
+ * A custom route is a hand-declared `llm-pi-ai.providers.<id>` profile that
+ * carries a `baseURL` and is NOT one of the built-in catalog routes
+ * (provider-catalog.ts): discovery against a catalog route would short-circuit
+ * back to the installed pi-ai catalog. This command interrogates
+ * each route's `GET ${baseURL}/models` through the official seam
+ * (`LlmRuntime.discoverModels`, registered for the `llm-pi-ai` namespace by
+ * dsh-llm-pi-ai with catalog short-circuit + stored-credential resolution),
+ * then merges the answer into the profile's `models` array.
+ *
+ * The merge is additive-only: existing entries are preserved verbatim (local
+ * overrides such as reasoningEfforts survive), discovered ids already present
+ * are skipped, new ids are appended with sanitized metadata. The write goes
+ * through `settings.mutate` at the revision read at execution time, with one
+ * retry after SettingsConflictError (the persistDefaultModel pattern in
+ * session.ts). Pure logic lives here as exported functions; src/index.ts only
+ * wires the command.
+ *
+ * @module dsh-tui-pi/model-sync
+ */
+import { settingsNamespace, SettingsConflictError } from '@deepseek-ai/dsh-settings';
+import { catalogEntry } from "./provider-catalog.js";
+/** The settings namespace dsh-llm-pi-ai owns its provider routes under. */
+const NS_LLM_PI_AI = settingsNamespace('llm-pi-ai');
+/**
+ * Read the providers dict out of an llm-pi-ai descriptor value. Tolerant of
+ * every malformed shape — a section that is not an object yields no routes.
+ */
+function readProviders(value) {
+    if (typeof value !== 'object' || value === null)
+        return {};
+    const providers = value.providers;
+    if (typeof providers !== 'object' || providers === null)
+        return {};
+    return providers;
+}
+function readProfile(raw) {
+    const source = typeof raw === 'object' && raw !== null ? raw : {};
+    const baseURL = typeof source.baseURL === 'string' && source.baseURL !== '' ? source.baseURL : undefined;
+    const api = typeof source.api === 'string' && source.api !== '' ? source.api : undefined;
+    const rawModels = Array.isArray(source.models) ? source.models : [];
+    // Only well-formed entries are merged against; a malformed stored row is
+    // left alone rather than deleted (additive-only merge).
+    const models = rawModels.filter((entry) => typeof entry === 'object' && entry !== null);
+    return { ...(baseURL !== undefined ? { baseURL } : {}), ...(api !== undefined ? { api } : {}), models };
+}
+/** The stored entry's id, when it is a non-empty string. */
+function storedModelId(entry) {
+    const id = entry.id;
+    return typeof id === 'string' && id !== '' ? id : undefined;
+}
+/**
+ * Select the custom (hand-declared) routes worth syncing from a providers
+ * dict: profiles carrying a non-empty `baseURL` whose key is not a built-in
+ * catalog route — a catalog key would short-circuit discovery back to the
+ * installed catalog. Sorted by route key so the
+ * report order is stable regardless of document order.
+ */
+export function selectCustomProviders(providers) {
+    const selected = [];
+    for (const [id, raw] of Object.entries(providers ?? {})) {
+        if (catalogEntry(id) !== undefined)
+            continue;
+        const profile = readProfile(raw);
+        if (profile.baseURL === undefined)
+            continue;
+        selected.push({
+            id,
+            baseURL: profile.baseURL,
+            ...(profile.api !== undefined ? { api: profile.api } : {}),
+        });
+    }
+    selected.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return selected;
+}
+/**
+ * Clean one discovered row into a writable models entry. The id is mandatory
+ * (blank/absent → undefined); name must be a non-blank string; capacities
+ * must be integers ≥ 1 — the llm-pi-ai schema rejects anything else at write
+ * time (`contextWindow >= 1`, integer step), and a field that fails stays
+ * behind rather than sinking the whole row (verified against the shipped
+ * schema: absent name/contextWindow/maxTokens validate fine).
+ */
+export function sanitizeDiscoveredModel(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const row = raw;
+    if (typeof row.id !== 'string')
+        return undefined;
+    const id = row.id.trim();
+    if (id === '')
+        return undefined;
+    const name = typeof row.name === 'string' && row.name.trim() !== '' ? row.name.trim() : undefined;
+    const capacity = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 1 ? value : undefined;
+    const contextWindow = capacity(row.contextWindow);
+    const maxTokens = capacity(row.maxTokens);
+    return {
+        id,
+        ...(name !== undefined ? { name } : {}),
+        ...(contextWindow !== undefined ? { contextWindow } : {}),
+        ...(maxTokens !== undefined ? { maxTokens } : {}),
+    };
+}
+/**
+ * Merge one route's discovery into its stored models — additive-only:
+ *
+ * - existing entries are the base and are preserved VERBATIM (local overrides
+ *   like reasoningEfforts/input/compat survive; nothing is overwritten or
+ *   deleted);
+ * - discovered rows join by id: an id already present (or repeated within the
+ *   batch) counts as skipped, local state wins;
+ * - new ids are appended with `sanitizeDiscoveredModel`'s cleaned fields;
+ * - the stored order is never touched: existing entries keep their positions
+ *   (id-less rows included) and new ids join at the end in discovery order.
+ */
+export function mergeModels(existing, discovered) {
+    const models = existing.map(entry => entry);
+    const ids = new Set();
+    for (const entry of models) {
+        const id = storedModelId(entry);
+        if (id !== undefined)
+            ids.add(id);
+    }
+    let added = 0;
+    let skipped = 0;
+    for (const raw of discovered) {
+        const clean = sanitizeDiscoveredModel(raw);
+        if (clean === undefined || ids.has(clean.id)) {
+            skipped += 1;
+            continue;
+        }
+        ids.add(clean.id);
+        // A fresh literal (not a cast): interfaces carry no implicit index
+        // signature, so the entry must be rebuilt as a plain record.
+        models.push({ ...clean });
+        added += 1;
+    }
+    // No reordering: existing entries stay exactly where the user stored them
+    // and new ids are appended at the end in discovery order — a no-op sync
+    // therefore leaves the stored array byte-identical.
+    return { models, added, kept: existing.length, skipped };
+}
+/**
+ * Write one route's merged models with optimistic concurrency: mutate at the
+ * revision read NOW (not at command start), one retry after
+ * SettingsConflictError with a freshly read revision — the same bottom pattern
+ * as persistDefaultModel in session.ts. A second conflict surfaces.
+ */
+async function writeModels(settings, providerId, models) {
+    const ops = [
+        { op: 'set', path: ['providers', providerId, 'models'], value: models },
+    ];
+    const ns = NS_LLM_PI_AI;
+    for (let attempt = 0;; attempt++) {
+        const descriptor = currentDescriptor(settings);
+        try {
+            await settings.mutate(ns, ops, descriptor?.revision);
+            return;
+        }
+        catch (error) {
+            if (attempt === 0 && error instanceof SettingsConflictError)
+                continue;
+            throw error;
+        }
+    }
+}
+/** The live llm-pi-ai descriptor, re-read on demand (revision freshness). */
+function currentDescriptor(settings) {
+    return settings.describe().find(d => d.ns === NS_LLM_PI_AI);
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Run one /model-sync round: select the target routes (the rawInput-named one,
+ * or every custom route), discover each endpoint's models, merge, and write
+ * back. One route's failure never aborts the rest — its line reports the
+ * reason instead. Agentless by design: nothing here touches a session.
+ *
+ * @returns the command result — per-provider `<id>: added N · kept M ·
+ *   skipped K` lines on success, `<id>: <reason>` for failed routes; `kind:
+ *   'error'` only for preconditions (missing namespace, unknown/non-custom
+ *   named route) or when EVERY route failed.
+ */
+export async function runModelSync(deps, options = {}) {
+    const descriptor = currentDescriptor(deps.settings);
+    if (descriptor === undefined) {
+        return { kind: 'error', text: 'The llm-pi-ai settings namespace is not registered — nothing to sync.' };
+    }
+    const wanted = options.rawInput?.trim() ?? '';
+    let targets;
+    if (wanted !== '') {
+        const providers = readProviders(descriptor.value);
+        if (!(wanted in providers)) {
+            return { kind: 'error', text: `Provider "${wanted}" is not configured under llm-pi-ai providers.` };
+        }
+        targets = selectCustomProviders({ [wanted]: providers[wanted] });
+        if (targets.length === 0) {
+            // Two distinct shapes land here: a built-in catalog key (excluded by
+            // selection even when the profile carries a baseURL) and a genuinely
+            // non-custom route without a baseURL. Name each accurately.
+            if (catalogEntry(wanted) !== undefined) {
+                return {
+                    kind: 'error',
+                    text: `Provider "${wanted}" is a built-in catalog route — /model-sync syncs hand-declared (baseURL) routes only.`,
+                };
+            }
+            return {
+                kind: 'error',
+                text: `Provider "${wanted}" has no baseURL — /model-sync syncs hand-declared routes only.`,
+            };
+        }
+    }
+    else {
+        targets = selectCustomProviders(readProviders(descriptor.value));
+        if (targets.length === 0) {
+            return { kind: 'success', text: 'No hand-declared (baseURL) providers configured — nothing to sync.' };
+        }
+    }
+    const lines = [];
+    let failures = 0;
+    for (const target of targets) {
+        try {
+            // Re-read the live section per route: an api added/removed between the
+            // selection and this write still reaches discovery (and a vanished
+            // namespace degrades into that route's failure line, not a crash).
+            const liveValue = currentDescriptor(deps.settings)?.value;
+            const profile = readProfile(readProviders(liveValue)[target.id]);
+            const discovered = await deps.llm.discoverModels(NS_LLM_PI_AI, {
+                provider: target.id,
+                baseURL: target.baseURL,
+                ...(profile.api !== undefined ? { api: profile.api } : {}),
+                ...(options.signal !== undefined ? { signal: options.signal } : {}),
+            });
+            const merged = mergeModels(profile.models, discovered);
+            // A no-op sync must produce zero settings mutations: write only when
+            // discovery actually contributed new ids.
+            if (merged.added > 0) {
+                await writeModels(deps.settings, target.id, merged.models);
+            }
+            lines.push(`${target.id}: added ${merged.added} · kept ${merged.kept} · skipped ${merged.skipped}`);
+        }
+        catch (error) {
+            failures += 1;
+            lines.push(`${target.id}: ${errorText(error)}`);
+        }
+    }
+    if (failures === targets.length && failures > 0) {
+        return { kind: 'error', text: lines.join('\n') };
+    }
+    return { kind: 'success', text: lines.join('\n') };
+}
+//# sourceMappingURL=model-sync.js.map

package/lib/model-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-sync.js","sourceRoot":"","sources":["../src/model-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AAGpF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,2EAA2E;AAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;AAuDnD;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC1D,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,CAAA;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAClE,OAAO,SAAoC,CAAA;AAC7C,CAAC;AASD,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACxG,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAA;IAC7G,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;AACzG,CAAC;AAED,4DAA4D;AAC5D,SAAS,aAAa,CAAC,KAAkB;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAA;IACnB,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA8C;IAE9C,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,SAAQ;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,SAAQ;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAA;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC7D,MAAM,GAAG,GAAG,GAAqF,CAAA;IACjG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAChD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAA;IACxB,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACjG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CACtD,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACzC,OAAO;QACL,EAAE;QACF,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,QAA+B,EAC/B,UAAkC;IAElC,MAAM,MAAM,GAAkB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAoB,CAAC,CAAA;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,EAAE,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACjB,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QACzB,KAAK,IAAI,CAAC,CAAA;IACZ,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,oDAAoD;IACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CACxB,QAAmC,EACnC,UAAkB,EAClB,MAAqB;IAErB,MAAM,GAAG,GAAqB;QAC5B,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;KACxE,CAAA;IACD,MAAM,EAAE,GAAsB,YAAY,CAAA;IAC1C,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC9C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY,qBAAqB;gBAAE,SAAQ;YACrE,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,QAAmC;IAC5D,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAmB,EACnB,UAAuD,EAAE;IAEzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,uEAAuE,EAAE,CAAA;IACzG,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7C,IAAI,OAA8B,CAAA;IAClC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,MAAM,gDAAgD,EAAE,CAAA;QACrG,CAAC;QACD,OAAO,GAAG,qBAAqB,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,qEAAqE;YACrE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,aAAa,MAAM,wFAAwF;iBAClH,CAAA;YACH,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,aAAa,MAAM,iEAAiE;aAC3F,CAAA;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,oEAAoE,EAAE,CAAA;QACxG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;YACzD,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;YAChE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,EAAE;gBAC7D,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;YACtD,qEAAqE;YACrE,0CAA0C;YAC1C,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,KAAK,WAAW,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,IAAI,CAAC,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AACpD,CAAC"}

package/lib/preflight-projcache.d.ts

@@ -0,0 +1,39 @@
+/**
+ * session_projcache record migration, shared by both mount points:
+ *
+ * - `bin/preflight-projcache.mjs` — the CLI shell the `dsh-tui-pi` launcher
+ *   runs before `exec dsh` (covers users starting through the launcher);
+ * - `src/projcache.ts` — the wrapper module the bundle patch mounts in place
+ *   of the stock `session-projection-cache` row (covers every `dsh --profile
+ *   tui` boot, launcher or not).
+ *
+ * The dsh 0.1.2-alpha.4 projection-cache schema hard-requires
+ * `identity.isSeeded: boolean` and `identity.inheritedEventCount: number`;
+ * records written by 0.1.1-rc.2-era hosts lack those fields and fail zod
+ * validation at storage-open time (`invalid-record`), which crashes the
+ * whole boot. The migration backfills exactly the missing fields, backs up
+ * every rewritten file next to the original, and always fails open — any
+ * error is a stderr warning, never a startup blocker.
+ */
+export interface PreflightResult {
+    checked: number;
+    fixed: number;
+}
+export interface PreflightOptions {
+    /** Report what would change without touching anything. */
+    check?: boolean;
+}
+/**
+ * The per-record sessions directory the stock plugin's storage domain opens
+ * at boot: `<DSH_HOME || ~/.dsh>/storages/session_projcache/sessions`.
+ */
+export declare function projcacheSessionsDir(home?: string): string;
+/**
+ * Backfill missing identity fields on every `session-*.json` record in
+ * `dir`. Already-migrated records are left byte-identical (no backup, no
+ * rewrite); unparsable or unreadable records are warned about and skipped;
+ * rewrite failures roll that record's count back and warn. Never throws for
+ * per-record problems — only a catastrophic `dir` scan failure propagates,
+ * and both callers catch it.
+ */
+export declare function preflightProjcache(dir: string, { check }?: PreflightOptions): PreflightResult;

package/lib/preflight-projcache.js

@@ -0,0 +1,116 @@
+/**
+ * session_projcache record migration, shared by both mount points:
+ *
+ * - `bin/preflight-projcache.mjs` — the CLI shell the `dsh-tui-pi` launcher
+ *   runs before `exec dsh` (covers users starting through the launcher);
+ * - `src/projcache.ts` — the wrapper module the bundle patch mounts in place
+ *   of the stock `session-projection-cache` row (covers every `dsh --profile
+ *   tui` boot, launcher or not).
+ *
+ * The dsh 0.1.2-alpha.4 projection-cache schema hard-requires
+ * `identity.isSeeded: boolean` and `identity.inheritedEventCount: number`;
+ * records written by 0.1.1-rc.2-era hosts lack those fields and fail zod
+ * validation at storage-open time (`invalid-record`), which crashes the
+ * whole boot. The migration backfills exactly the missing fields, backs up
+ * every rewritten file next to the original, and always fails open — any
+ * error is a stderr warning, never a startup blocker.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const BACKFILL = { isSeeded: false, inheritedEventCount: 0 };
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function warn(message) {
+    process.stderr.write(`[preflight-projcache] ${message}\n`);
+}
+/**
+ * The per-record sessions directory the stock plugin's storage domain opens
+ * at boot: `<DSH_HOME || ~/.dsh>/storages/session_projcache/sessions`.
+ */
+export function projcacheSessionsDir(home = process.env.DSH_HOME || path.join(os.homedir(), '.dsh')) {
+    return path.join(home, 'storages', 'session_projcache', 'sessions');
+}
+function backupPathFor(file) {
+    const stamp = new Date().toISOString();
+    let candidate = `${file}.bak-preflight-${stamp}`;
+    for (let n = 2; fs.existsSync(candidate); n++) {
+        candidate = `${file}.bak-preflight-${stamp}-${n}`;
+    }
+    return candidate;
+}
+/**
+ * Backfill missing identity fields on every `session-*.json` record in
+ * `dir`. Already-migrated records are left byte-identical (no backup, no
+ * rewrite); unparsable or unreadable records are warned about and skipped;
+ * rewrite failures roll that record's count back and warn. Never throws for
+ * per-record problems — only a catastrophic `dir` scan failure propagates,
+ * and both callers catch it.
+ */
+export function preflightProjcache(dir, { check = false } = {}) {
+    const result = { checked: 0, fixed: 0 };
+    if (!fs.existsSync(dir))
+        return result;
+    for (const name of fs.readdirSync(dir)) {
+        if (!/^session-.*\.json$/.test(name))
+            continue;
+        const file = path.join(dir, name);
+        if (!fs.statSync(file).isFile())
+            continue;
+        result.checked++;
+        let text;
+        try {
+            text = fs.readFileSync(file, 'utf8');
+        }
+        catch (err) {
+            warn(`unreadable ${name}: ${errorMessage(err)}`);
+            continue;
+        }
+        let obj;
+        try {
+            obj = JSON.parse(text);
+        }
+        catch {
+            warn(`skipping unparsable ${name}`);
+            continue;
+        }
+        if (!isPlainObject(obj))
+            continue;
+        let identity = obj.identity;
+        if (identity === undefined) {
+            identity = {};
+            obj.identity = identity;
+        }
+        if (!isPlainObject(identity))
+            continue;
+        let changed = false;
+        for (const [field, value] of Object.entries(BACKFILL)) {
+            if (identity[field] === undefined) {
+                identity[field] = value;
+                changed = true;
+            }
+        }
+        if (!changed)
+            continue;
+        result.fixed++;
+        if (check)
+            continue;
+        try {
+            fs.writeFileSync(backupPathFor(file), text);
+            const migrated = JSON.stringify(obj, null, 2) + (text.endsWith('\n') ? '\n' : '');
+            const tmp = `${file}.tmp-preflight-${process.pid}`;
+            fs.writeFileSync(tmp, migrated);
+            fs.renameSync(tmp, file);
+        }
+        catch (err) {
+            result.fixed--;
+            warn(`failed to rewrite ${name}: ${errorMessage(err)}`);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=preflight-projcache.js.map

package/lib/preflight-projcache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-projcache.js","sourceRoot":"","sources":["../src/preflight-projcache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAW,CAAA;AAYrE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,IAAI,CAAC,CAAA;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,SAAS,GAAG,GAAG,IAAI,kBAAkB,KAAK,EAAE,CAAA;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,SAAS,GAAG,GAAG,IAAI,kBAAkB,KAAK,IAAI,CAAC,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,EAAE,KAAK,GAAG,KAAK,KAAuB,EAAE;IACtF,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAA;IAEtC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,SAAQ;QACzC,MAAM,CAAC,OAAO,EAAE,CAAA;QAEhB,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,IAAI,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAChD,SAAQ;QACV,CAAC;QACD,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;YACnC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,SAAQ;QAEjC,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,EAAE,CAAA;YACb,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAEtC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;gBACvB,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,IAAI,KAAK;YAAE,SAAQ;QACnB,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACjF,MAAM,GAAG,GAAG,GAAG,IAAI,kBAAkB,OAAO,CAAC,GAAG,EAAE,CAAA;YAClD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC/B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,CAAC,qBAAqB,IAAI,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/lib/projcache.d.ts

@@ -0,0 +1,2 @@
+export * from '@deepseek-ai/dsh-session-projection-cache';
+export { default } from '@deepseek-ai/dsh-session-projection-cache';

package/lib/projcache.js

@@ -0,0 +1,32 @@
+/**
+ * Boot-time replacement for the stock `session-projection-cache` bundle row.
+ *
+ * cordis.patch.yml disables the stock row and inserts an entry mounting this
+ * module instead. The alpha.4 schema fail-fasts at storage-open on records
+ * written by 0.1.1-rc.2-era hosts, and that happens inside the stock
+ * plugin's own Service.init — no later-initializing plugin can intercept it,
+ * the loader tears down the whole boot. Module evaluation is the only hook
+ * the loader reaches strictly before Service.init, so the migration runs
+ * here, at import time, backfilling the legacy records on disk before the
+ * stock code opens its storage domain.
+ *
+ * The stock module itself has no import-time side effects (class and zod
+ * schema definitions only), so the hoisted re-export below evaluating first
+ * is harmless. Migration is fail-open: any error warns on stderr and leaves
+ * the boot exactly where it would have been without the wrapper.
+ *
+ * Consumers of the stock package's named exports import
+ * `@deepseek-ai/dsh-session-projection-cache` directly and share this same
+ * module instance; only the loader reaches the plugin through here.
+ */
+import { preflightProjcache, projcacheSessionsDir } from './preflight-projcache.js';
+try {
+    preflightProjcache(projcacheSessionsDir());
+}
+catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[preflight-projcache] skipped: ${message}\n`);
+}
+export * from '@deepseek-ai/dsh-session-projection-cache';
+export { default } from '@deepseek-ai/dsh-session-projection-cache';
+//# sourceMappingURL=projcache.js.map

package/lib/projcache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projcache.js","sourceRoot":"","sources":["../src/projcache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEnF,IAAI,CAAC;IACH,kBAAkB,CAAC,oBAAoB,EAAE,CAAC,CAAA;AAC5C,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,OAAO,IAAI,CAAC,CAAA;AACrE,CAAC;AAED,cAAc,2CAA2C,CAAA;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwayds/dsh-tui-pi",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "pi-style terminal UI for DeepSeek Harness (dsh) — pi-tui look & feel, dsh slash commands, GitHub light/dark themes, powerline footer",
   "repository": {
     "type": "git",
@@ -19,6 +19,18 @@
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./projcache": {
+      "types": "./lib/projcache.d.ts",
+      "default": "./lib/projcache.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "dsh-tui-pi": "bin/dsh-tui-pi"
   },

package/scripts/smoke-boot.mjs

@@ -8,10 +8,15 @@
 //      dsh.profile.bundles entry (same shape as the user's real profiles)
 //   3. pnpm install
 //   4. `dsh --profile smoke --dump-config` must compose the plugin into the
-//      tree (mount/patch-layer proof)
-//   5. a real boot under a timeout must load the plugin tree without a
+//      tree (mount/patch-layer proof), disable the stock projection-cache
+//      row and mount the projcache wrapper in its place
+//   5. a legacy session_projcache record (the 0.1.1-rc.2 shape that the
+//      alpha.4 schema fail-fasts on) is seeded into the scratch home; the
+//      boot below must migrate it, not crash on it
+//   6. a real boot under a timeout must load the plugin tree without a
 //      loader error (a healthy boot is silent and survives to the kill
-//      signal; a broken plugin dies within ~1s with the loader error)
+//      signal; a broken plugin dies within ~1s with the loader error), and
+//      the seeded record must come out backfilled + backed up
 //
 // The boot runs piped (no TTY). Verified empirically: the TUI plugin's
 // apply() tolerates a non-terminal (pi-tui guards raw mode), so the piped
@@ -21,7 +26,7 @@
 // removed on success.
 
 import { spawnSync } from 'node:child_process'
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
@@ -75,12 +80,32 @@ if (install.status !== 0 || install.error) fail('pnpm install in the scratch pro
 
 const dshEnv = { ...process.env, DSH_HOME: home, TERM: process.env.TERM ?? 'xterm-256color' }
 
-// Phase 1 — mount proof: the composed tree must include the plugin.
+// Phase 1 — mount proof: the composed tree must include the plugin, disable
+// the stock projection-cache row and mount the projcache wrapper instead.
 const dump = spawnSync('dsh', ['--profile', 'smoke', '--dump-config'], { cwd: profile, encoding: 'utf8', env: dshEnv })
 if (dump.status !== 0 || dump.error) fail('dsh --dump-config failed on the scratch profile', `${dump.stdout}\n${dump.stderr}`)
 if (!dump.stdout.includes(ownName)) {
   fail(`the composed profile tree does not contain ${ownName} — the bundle patch insert is broken`, dump.stdout)
 }
+if (!/id: session-projection-cache[\s\S]*?disabled: true/.test(dump.stdout)) {
+  fail('the stock session-projection-cache row is not disabled — the wrapper would race a second mount', dump.stdout)
+}
+if (!dump.stdout.includes('tui-pi-projcache')) {
+  fail('the projcache wrapper entry is missing from the composed tree — legacy records would crash the boot', dump.stdout)
+}
+
+// Phase 1.5 — seed a legacy projection-cache record: the 0.1.1-rc.2 shape
+// lacks the identity fields the alpha.4 schema requires. The boot in phase 2
+// must migrate it (lib/projcache.js, module-evaluation time) instead of
+// dying on it at storage-open.
+const sessionsDir = path.join(home, 'storages', 'session_projcache', 'sessions')
+mkdirSync(sessionsDir, { recursive: true })
+const legacyName = 'session-smoke-legacy.json'
+const legacyOriginal = JSON.stringify({
+  identity: { createdAt: 1756000000000, cwd: '/tmp/smoke' },
+  events: [{ seq: 1 }],
+}, null, 2)
+writeFileSync(path.join(sessionsDir, legacyName), legacyOriginal)
 
 // Phase 2 — boot proof: the plugin tree must LOAD without a loader error.
 const bootSeconds = 25
@@ -95,6 +120,7 @@ const output = `${boot.stdout ?? ''}\n${boot.stderr ?? ''}`
 const loaderErrors = [
   /plugin tree failed to load/,
   /failed to apply loader entry/,
+  /does not match its schema/,
   /cannot get property ".*" without inject/,
   /cannot get required service/,
   /Cannot find (package|module)/,
@@ -113,5 +139,29 @@ if (!survived && boot.status !== 0) {
   fail(`dsh exited early with code ${boot.status} and no loader error — unexpected`, output)
 }
 
-console.log(`smoke-boot: PASS — ${ownName} composed into the scratch profile tree and booted clean in real dsh (${survived ? `survived the ${bootSeconds}s boot window` : `exited ${boot.status}`})`)
+// Phase 3 — rescue proof: the seeded legacy record must have been backfilled
+// by the wrapper before the stock plugin could open the domain, with the
+// original bytes backed up next to it.
+const legacyNow = path.join(sessionsDir, legacyName)
+const backups = (() => {
+  try {
+    return readdirSync(sessionsDir).filter((n) => n.startsWith(`${legacyName}.bak-preflight-`))
+  } catch {
+    return []
+  }
+})()
+if (!backups.length) {
+  fail('the seeded legacy record was never migrated — the wrapper did not run at module-evaluation time', output)
+}
+let migrated
+try {
+  migrated = JSON.parse(readFileSync(legacyNow, 'utf8'))
+} catch (err) {
+  fail(`the migrated legacy record is unparsable: ${err.message}`)
+}
+if (migrated.identity?.isSeeded !== false || migrated.identity?.inheritedEventCount !== 0) {
+  fail('the seeded legacy record survived the boot without being backfilled', JSON.stringify(migrated.identity))
+}
+
+console.log(`smoke-boot: PASS — ${ownName} composed into the scratch profile tree and booted clean in real dsh (${survived ? `survived the ${bootSeconds}s boot window` : `exited ${boot.status}`}); the seeded legacy projection-cache record was migrated with a backup`)
 rmSync(work, { recursive: true, force: true })