@askdkc/dsh-cli 0.11.3

package/lib/types/dsh-adapter/channel/external-commands.js

@@ -0,0 +1,187 @@
+import { installedMeetsVersion } from '../contract.js';
+import { commandOwner } from '../command-attribution.js';
+import { assertCapabilityShadowPolicy } from '../../adapter/kernel/runtime.js';
+import { t } from '../../i18n.js';
+import { firstStaleComposerToken, orderedComposerImages } from './composer-images.js';
+/** Plugin-command invocation has one owner: this module owns gates, image
+ *  encoding and the settled draft-consumption outcome. */
+export function createExternalCommandInvoker(ctx, deps) {
+    /** Whether the installed command service takes composer images: version
+     *  gate (composer images arrived on 0.1.0-rc.8 and every later family —
+     *  0.1.1 included — keeps the 4-param shape) with a structural fallback,
+     *  so a failed manifest probe (bundlers, exotic loaders) still lands on
+     *  the 4-param rc.8 shape at runtime. */
+    const supportsImages = (service) => installedMeetsVersion('@deepseek-ai/dsh-commands', '0.1.0-rc.8')
+        || (typeof service.execute.length === 'number' && service.execute.length >= 4);
+    const authorize = (definition, name) => {
+        // Derive identity from the effective definition, never the display name:
+        // scoped same-name handlers can have different verified owners.
+        const owner = commandOwner(ctx, definition);
+        const rootScope = owner?.commandId ?? (/^[a-z][a-z0-9]*(?:[.-][a-z0-9][a-z0-9-]*)+$/u.test(name) ? name : `dsh-tui.${name.toLowerCase().replace(/[^a-z0-9-]+/gu, '-').replace(/^-+|-+$/gu, '') || 'command'}`);
+        if (!deps.allows({ componentId: 'root' }, 'commands.invoke', rootScope)) {
+            ctx.logger.warn('dsh-tui: registry command invocation denied (commands.invoke revoked for "root" in the grants file)');
+            ctx.get('tuiEffectLedger')?.record({ operation: 'bind', resource: { kind: 'permission', id: `root:commands.invoke:${rootScope}` }, result: 'failed', errorCode: 'PERMISSION_NOT_GRANTED' }, ctx);
+            return t('command-invoke-denied');
+        }
+        if (owner !== undefined && !deps.allows({ componentId: owner.componentId, activationId: owner.activationId }, 'commands.invoke', owner.commandId)) {
+            ctx.logger.warn(`dsh-tui: registry command "/${name}" invocation denied — owner Component "${owner.componentId}" lost commands.invoke for "${owner.commandId}"`);
+            ctx.get('tuiEffectLedger')?.record({ operation: 'bind', resource: { kind: 'permission', id: `${owner.componentId}:commands.invoke:${owner.commandId}` }, result: 'failed', errorCode: 'PERMISSION_NOT_GRANTED' }, ctx);
+            return t('command-invoke-denied-owner', { name, owner: owner.componentId });
+        }
+        return undefined;
+    };
+    /** Encode the staged `@`-mention images the user pasted for THIS command
+     *  line into rc.8's `EncodedImageAttachment` payloads; `kind: 'legacy'`
+     *  means the installed dsh-commands line predates composer images
+     *  (rc.7/rc.6), so the caller uses the legacy 3-arg invoke. Matches the
+     *  submit pipeline's token rule (expandComposerMentions): a staged image
+     *  attaches only when the line references its token. The composer
+     *  preflights `input.images`, but this adapter still forwards every
+     *  supplied image: rc.8 owns admission, so non-UI callers cannot
+     *  accidentally bypass the registry contract. Preparation is atomic:
+     *  limits are checked from durable metadata before any read/base64 work,
+     *  and one missing or unreadable image prevents the handler from running
+     *  with a silently truncated batch. */
+    const registryCommandImages = async (service, line, imageRefs, staged, signal) => {
+        const ordered = orderedComposerImages(line, imageRefs, staged);
+        // A `[Image #N]` with no live staging is plain text here, exactly as on
+        // the submit path: warn once, keep the line unchanged. Only referenced,
+        // staged images take part in the batch below.
+        const stale = firstStaleComposerToken(line, ordered);
+        if (stale !== undefined) {
+            deps.notify(t('input-image-token-stale', { token: stale }), { color: 'warning', timeoutMs: 5000 });
+        }
+        if (!supportsImages(service)) {
+            return ordered.size > 0
+                ? { kind: 'error', reason: 'runtime', tokens: [...ordered.keys()] }
+                : { kind: 'legacy' };
+        }
+        if (ordered.size === 0)
+            return { kind: 'ready', images: [] };
+        const store = deps.attachments();
+        if (typeof store?.readImage !== 'function') {
+            return { kind: 'error', reason: 'missing', tokens: [...ordered.keys()] };
+        }
+        const { imageLimits: limits } = store;
+        let declaredBytes = 0;
+        for (const attachment of ordered.values()) {
+            if (!Number.isSafeInteger(attachment.bytes)
+                || attachment.bytes <= 0
+                || attachment.bytes > limits.maxImageBytes
+                || !limits.mediaTypes.includes(attachment.mediaType)) {
+                return { kind: 'error', reason: 'limits', tokens: [...ordered.keys()] };
+            }
+            declaredBytes += attachment.bytes;
+        }
+        if (ordered.size > limits.maxImagesPerMessage
+            || declaredBytes > limits.maxMessageImageBytes) {
+            return { kind: 'error', reason: 'limits', tokens: [...ordered.keys()] };
+        }
+        const loaded = [];
+        let actualBytes = 0;
+        for (const [token, attachment] of ordered) {
+            try {
+                const stored = await store.readImage(attachment, signal);
+                if (!(stored?.data instanceof Uint8Array) || stored.data.byteLength <= 0) {
+                    return { kind: 'error', reason: 'missing', tokens: [token] };
+                }
+                actualBytes += stored.data.byteLength;
+                if (stored.data.byteLength > limits.maxImageBytes
+                    || actualBytes > limits.maxMessageImageBytes) {
+                    return { kind: 'error', reason: 'limits', tokens: [...ordered.keys()] };
+                }
+                loaded.push({ token, attachment, data: stored.data });
+            }
+            catch {
+                return { kind: 'error', reason: 'missing', tokens: [token] };
+            }
+        }
+        return {
+            kind: 'ready',
+            images: loaded.map(({ attachment, data }) => ({
+                // Older image-only runtimes ignore the discriminator; 0.1.5 uses it
+                // to distinguish encoded images from stored file attachments.
+                type: 'image',
+                mediaType: attachment.mediaType,
+                data: Buffer.from(data).toString('base64'),
+                name: attachment.name,
+            })),
+        };
+    };
+    /** Run one DSH registry command (`/plan`, …) on the live agent while
+     *  preserving its settled result kind for composer admission. */
+    const invoke = async (name, rawInput, imageRefs = []) => {
+        const capture = deps.capture();
+        assertCapabilityShadowPolicy('host.commands.invoke', deps.runtime.mode, deps.runtime.slices);
+        const service = deps.commandService;
+        if (service === undefined)
+            return undefined;
+        const commandAgent = deps.agent();
+        const stagedSnapshot = deps.composer.snapshot();
+        // Resolve the exact definition that execute() will select for this agent.
+        // Same names may exist in distinct agent scopes, so a name-only lookup can
+        // apply another scope's owner policy.
+        const definition = service.find(commandAgent, name);
+        try {
+            const signal = new AbortController().signal;
+            const line = `/${name}${rawInput}`;
+            const batch = await registryCommandImages(service, line, deps.composer.includeLegacyImageRefs(line, imageRefs), stagedSnapshot, signal);
+            if (batch.kind === 'error') {
+                const text = batch.reason === 'runtime'
+                    ? t('command-images-runtime-unsupported', { name })
+                    : batch.reason === 'limits'
+                        ? t('command-images-limit', { name })
+                        : t('command-images-missing', { name, paths: batch.tokens.join(' ') });
+                return { kind: 'error', text, consumeDraft: false };
+            }
+            // Image preparation can await storage. Do not authorize definition A
+            // and then execute a newly registered same-name definition B after A
+            // was unloaded while those reads were pending.
+            if (service.find(commandAgent, name) !== definition) {
+                return { kind: 'error', text: t('command-changed', { name }), consumeDraft: false };
+            }
+            if (!deps.bindingCurrent(capture)) {
+                deps.notify(t('ext-stale-dropped'), { color: 'warning', timeoutMs: 4000 });
+                return { kind: 'error', text: '', consumeDraft: false };
+            }
+            // Grants are a live per-operation decision. Image reads above may
+            // park, so take the single authoritative snapshot only now — after
+            // preparation/identity guards and immediately before execute.
+            const denied = authorize(definition, name);
+            if (denied !== undefined)
+                return { kind: 'error', text: denied, consumeDraft: false };
+            // rc.8 moved the signal to the 4th parameter and added composer
+            // images; older lines (rc.7/rc.6) take (agent, line, signal).
+            const execution = batch.kind === 'legacy'
+                ? await service.execute(commandAgent, line, signal)
+                : await service.execute(commandAgent, line, batch.images, signal);
+            // The handler itself may park. Its durable lifecycle belongs to the
+            // old agent, but its toast/consume acknowledgment must never land on a
+            // replacement session after /new, resume, rewind, or model switch.
+            if (!deps.bindingCurrent(capture))
+                return { kind: 'error', text: '', consumeDraft: false };
+            if (execution === undefined)
+                return undefined;
+            return execution.result.kind === 'success'
+                ? { kind: 'success', text: execution.result.text ?? '', consumeDraft: true }
+                : {
+                    kind: 'error',
+                    text: execution.result.text,
+                    // Upstream composers retain image-bearing handler failures so
+                    // the user can fix the grammar without rebuilding attachments;
+                    // imageless handler errors remain consumed durable outcomes.
+                    consumeDraft: batch.kind === 'ready' ? batch.images.length === 0 : true,
+                };
+        }
+        catch (error) {
+            return {
+                kind: 'error',
+                text: error instanceof Error ? error.message : String(error),
+                consumeDraft: false,
+            };
+        }
+    };
+    /** Text-only companion kept for the public scene-facing API. */
+    const invokeText = async (name, rawInput, imageRefs = []) => (await invoke(name, rawInput, imageRefs))?.text;
+    return { invoke, invokeText };
+}

package/lib/types/dsh-adapter/channel/file-actions.d.ts

@@ -0,0 +1,20 @@
+import type { FileCandidate } from '../../utils/fileSuggestions.js';
+import type { MentionFs } from './types.js';
+/** Workspace file queries and their per-cwd scan cache. */
+export declare function createFileActions(deps: {
+    owner: {
+        current(): boolean;
+        readonly signal: AbortSignal;
+    };
+    capture(): unknown;
+    current(capture: unknown): boolean;
+    cwd(): string;
+    fs(): MentionFs | undefined;
+}): {
+    listFileCandidates: (query: string, options?: {
+        signal?: AbortSignal;
+        topK?: number;
+    }) => Promise<readonly FileCandidate[]>;
+    listFiles: () => Promise<readonly string[]>;
+};
+//# sourceMappingURL=file-actions.d.ts.map

package/lib/types/dsh-adapter/channel/file-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-actions.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/file-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE;QAAE,OAAO,IAAI,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAA;IAC3D,OAAO,IAAI,OAAO,CAAA;IAClB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAA;IAClC,GAAG,IAAI,MAAM,CAAA;IACb,EAAE,IAAI,SAAS,GAAG,SAAS,CAAA;CAC5B;gCAQU,MAAM,YACH;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC;qBA2BR,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;EAQvD"}

package/lib/types/dsh-adapter/channel/file-actions.js

@@ -0,0 +1,45 @@
+import { isPathLikeQuery, rankFileCandidates } from '../../utils/fileSuggestions.js';
+import { listFilesDeepCandidates, listPathCandidates } from './paths.js';
+/** Workspace file queries and their per-cwd scan cache. */
+export function createFileActions(deps) {
+    let cache = { cwd: '' };
+    const isCurrent = (capture, cwd) => deps.owner.current() && deps.current(capture) && deps.cwd() === cwd;
+    const withOwnerSignal = (signal) => signal === undefined ? deps.owner.signal : AbortSignal.any([signal, deps.owner.signal]);
+    const listFileCandidates = async (query, options) => {
+        const capture = deps.capture();
+        const cwd = deps.cwd();
+        const fs = deps.fs();
+        const signal = withOwnerSignal(options?.signal);
+        if (!fs || signal.aborted || !isCurrent(capture, cwd))
+            return [];
+        if (isPathLikeQuery(query)) {
+            const result = await listPathCandidates(fs, cwd, query, signal, options?.topK ?? 50);
+            return isCurrent(capture, cwd) && !signal.aborted ? result : [];
+        }
+        if (cache.cwd !== cwd)
+            cache = { cwd };
+        const scan = cache;
+        // The scan belongs to this Channel/CWD cache entry, not to its first
+        // waiter. A caller cancellation only suppresses that caller's result;
+        // owner disposal remains the shared scan's cancellation fence.
+        scan.load ??= listFilesDeepCandidates(fs, cwd, deps.owner.signal).then(candidates => {
+            // Do not retain a cancelled/empty observation; a later request may have
+            // a live owner or find files that appeared after this scan. An older
+            // CWD scan must not clear a newer entry after it settles.
+            if (candidates.length === 0 && cache === scan)
+                scan.load = undefined;
+            return candidates;
+        });
+        const candidates = await scan.load;
+        if (!isCurrent(capture, cwd) || signal.aborted)
+            return [];
+        return rankFileCandidates(candidates, query, options?.topK ?? 50);
+    };
+    const listFiles = async () => {
+        const capture = deps.capture();
+        const cwd = deps.cwd();
+        const candidates = await listFilesDeepCandidates(deps.fs(), cwd, deps.owner.signal);
+        return isCurrent(capture, cwd) ? candidates.map(candidate => candidate.path) : [];
+    };
+    return { listFileCandidates, listFiles };
+}

package/lib/types/dsh-adapter/channel/ide-selection.d.ts

@@ -0,0 +1,58 @@
+import type { ChannelSelection, SelectionAttachment } from '../../adapter/ports/channel-view.js';
+import type { MentionExpansion, MentionFs } from './types.js';
+/**
+ * Escape a path for reuse inside a quoted `<attached-file path="…">` attribute:
+ * POSIX filenames are legal with `"`, `&`, `<`, `>` — a raw interpolated path
+ * could break out of the attribute or smuggle markup into the model-facing
+ * block. `&` first so the replacements themselves are not re-escaped.
+ */
+export declare function escapeSnippetAttr(value: string): string;
+/**
+ * Build the `<attached-file path="…" selection>` block for an IDE selection:
+ * coordinates arrive 0-based inclusive from the extension and convert to
+ * sliceLines' 1-based; an endLine past EOF clamps to the last line (the model
+ * receives every remaining line), while a startLine past EOF yields undefined
+ * — the caller silently skips instead of attaching an empty or stale block.
+ * An empty selection is rejected here too so the guard cannot be bypassed.
+ */
+export declare function buildSelectionBlock(selection: ChannelSelection, content: string): {
+    text: string;
+    lines: number;
+} | undefined;
+/**
+ * Append the selection's attached-file block to a message's content. Returns
+ * what was attached ({lines, path}) or undefined when there is nothing to
+ * attach — no selection, or an unresolvable/unreadable file. The caller
+ * passes the ENQUEUE-time snapshot (and its fs handle) so a selection made
+ * after submit can never attach to the wrong message.
+ *
+ * Protocol 2 carries the editor buffer's own `text` (unsaved edits
+ * included): when present it is attached VERBATIM and the filesystem is not
+ * touched — reading the disk copy would hand the model a version the user
+ * never saw (maintainer review round 3). The disk read remains only as the
+ * protocol-1 fallback.
+ */
+export declare function attachIdeSelection(blocks: MentionExpansion['blocks'], cwd: string, selection: ChannelSelection | undefined, fs: MentionFs | undefined): Promise<SelectionAttachment | undefined>;
+/**
+ * Derive the transcript indicator from the DURABLE user-message content:
+ * the `<attached-file path="…" selection count="N">` block the submit path
+ * appended is part of the persisted event, so a replayed session can rebuild
+ * the "Selected N lines from <file>" line even though the in-memory
+ * message-id → attachment map starts empty (maintainer review round 3: the
+ * session log is the source of truth — the indicator must not depend on
+ * process-local state).
+ */
+export declare function replaySelectionAttachment(content: readonly unknown[] | undefined): SelectionAttachment | undefined;
+/**
+ * Bounded map from a submitted message id → what its selection attached.
+ * The delivery path remembers at submit; the transcript projection reads it
+ * when the durable `user/message` event lands (the event carries the same
+ * message id) to stamp the row's indicator. FIFO-capped like the other
+ * row-keyed caches — ids grow monotonically and a miss only loses the
+ * indicator, never the attachment itself.
+ */
+export declare function createSelectionAttachments(): {
+    remember(messageId: string, info: SelectionAttachment): void;
+    take(messageId: string): SelectionAttachment | undefined;
+};
+//# sourceMappingURL=ide-selection.d.ts.map

package/lib/types/dsh-adapter/channel/ide-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ide-selection.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/ide-selection.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAA;AAEhG,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAuB7D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAyCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAc7C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAClC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,EAAE,EAAE,SAAS,GAAG,SAAS,GACxB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAoC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,GACtC,mBAAmB,GAAG,SAAS,CA8BjC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC5D,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAAA;CACzD,CAeA"}

package/lib/types/dsh-adapter/channel/ide-selection.js

@@ -0,0 +1,226 @@
+/**
+ * IDE selection consumption: turn a live editor-selection snapshot into the
+ * model-facing `<attached-file … selection>` block. Protocol 2 pushes carry
+ * the editor buffer's own selection text — that is attached verbatim; the
+ * disk read below remains only as the protocol-1 fallback, and every failure
+ * mode is silent (an IDE-side extra must never block a send).
+ *
+ * The block builder never goes through text parsing (unlike `@`-mentions):
+ * selection paths may contain spaces no tokenizer could survive. It reuses
+ * the same line-slice semantics and size-cap policy as mention attachments.
+ */
+import { isAbsolute, join } from 'node:path';
+import { MENTION_MAX_FILE_CHARS } from './mentions.js';
+/**
+ * Slice `content` into the 1-based inclusive [`startLine`, `endLine`] range.
+ * Returns undefined for malformed ranges (non-safe integers, zero/negative
+ * start, inverted) and for a start past EOF — counted against REAL lines: a
+ * trailing newline splits into a phantom final element that is not a line.
+ */
+function sliceLines(content, startLine, endLine) {
+    const end = endLine ?? startLine;
+    if (!Number.isSafeInteger(startLine) || startLine < 1)
+        return undefined;
+    if (!Number.isSafeInteger(end) || end < startLine)
+        return undefined;
+    const lines = content.split('\n');
+    // A trailing newline splits into a phantom final element that is not a line.
+    if (lines.length > 1 && lines[lines.length - 1] === '')
+        lines.pop();
+    if (startLine > lines.length)
+        return undefined;
+    return lines.slice(startLine - 1, end).join('\n');
+}
+/**
+ * Escape a path for reuse inside a quoted `<attached-file path="…">` attribute:
+ * POSIX filenames are legal with `"`, `&`, `<`, `>` — a raw interpolated path
+ * could break out of the attribute or smuggle markup into the model-facing
+ * block. `&` first so the replacements themselves are not re-escaped.
+ */
+export function escapeSnippetAttr(value) {
+    return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/**
+ * Format the attached-file block from an ALREADY-SLICED body: cap it like
+ * @-mention attachments (same MENTION_MAX_FILE_CHARS policy, same visible
+ * truncation marker) and count the lines the model gets — the truncated body,
+ * not the request (review round 3).
+ *
+ * `allowEmpty` keeps a selection that covers ONE blank line: the body is
+ * legitimately empty there while the badge still says "1 line selected", and
+ * dropping the block made the footer and the transcript disagree (review
+ * round 7). Callers pass it only for a single-line range that really exists.
+ */
+function cappedSelectionBlock(path, sliced, allowEmpty = false) {
+    if (sliced === '' && !allowEmpty)
+        return undefined;
+    let body = sliced;
+    let attached = sliced;
+    if (body.length > MENTION_MAX_FILE_CHARS) {
+        attached = body.slice(0, MENTION_MAX_FILE_CHARS);
+        body = `${attached}\n[… truncated]`;
+    }
+    // `count` is the number of lines in the attached BODY — the truncation
+    // marker line is not counted (it rides on top of the cap and the live
+    // indicator reports the same number). It exists so the replay path never has
+    // to GUESS that number from the body tail: a selection whose last line is
+    // literally `[… truncated]` used to lose one line when the indicator was
+    // rebuilt from the persisted event (fuzz rounds found 46/400 such bodies).
+    // Deliberately NOT `lines`: @-mention attachments already use `lines="2-4"`
+    // for the REQUESTED range, and overloading the key with a count would make
+    // the two block flavours read alike.
+    const lines = attached.split('\n').length;
+    return {
+        text: `<attached-file path="${escapeSnippetAttr(path)}" selection count="${lines}">\n${body}\n</attached-file>`,
+        lines,
+    };
+}
+/**
+ * Build the `<attached-file path="…" selection>` block for an IDE selection:
+ * coordinates arrive 0-based inclusive from the extension and convert to
+ * sliceLines' 1-based; an endLine past EOF clamps to the last line (the model
+ * receives every remaining line), while a startLine past EOF yields undefined
+ * — the caller silently skips instead of attaching an empty or stale block.
+ * An empty selection is rejected here too so the guard cannot be bypassed.
+ */
+export function buildSelectionBlock(selection, content) {
+    if (selection.isEmpty)
+        return undefined;
+    // 0-based inclusive [start, end] → 1-based inclusive [start+1, end+1].
+    // sliceLines clamps an oversized end itself (Array#slice bounds); a start
+    // past EOF returns undefined and the whole attach is silently dropped.
+    const sliced = sliceLines(content, selection.startLine + 1, selection.endLine + 1);
+    if (sliced === undefined)
+        return undefined;
+    // sliceLines returning '' (not undefined) means the requested line EXISTS and
+    // is blank — a single blank line is a real selection the badge reports.
+    return cappedSelectionBlock(selection.path, sliced, selection.startLine === selection.endLine);
+}
+/**
+ * Append the selection's attached-file block to a message's content. Returns
+ * what was attached ({lines, path}) or undefined when there is nothing to
+ * attach — no selection, or an unresolvable/unreadable file. The caller
+ * passes the ENQUEUE-time snapshot (and its fs handle) so a selection made
+ * after submit can never attach to the wrong message.
+ *
+ * Protocol 2 carries the editor buffer's own `text` (unsaved edits
+ * included): when present it is attached VERBATIM and the filesystem is not
+ * touched — reading the disk copy would hand the model a version the user
+ * never saw (maintainer review round 3). The disk read remains only as the
+ * protocol-1 fallback.
+ */
+export async function attachIdeSelection(blocks, cwd, selection, fs) {
+    if (selection === undefined || selection.isEmpty)
+        return undefined;
+    if (selection.text !== undefined) {
+        // Protocol 2: `text` is the editor's OWN text for the selection
+        // (document.getText(selection)) — the ABSOLUTE document coordinates ride
+        // along for the badge/indicator, but they must NOT slice this string:
+        // it already contains exactly the selected lines, so anything not
+        // starting at line 0 would be mis-cut or dropped entirely (review
+        // round 4). Attach it verbatim with the shared size cap. A full-line
+        // selection ends at column 0 of the NEXT line, so getText hands back a
+        // trailing '\n' — strip that one terminator or the body grows a phantom
+        // blank line and the indicator over-counts by one (review round 5).
+        let text = selection.text;
+        if (text.endsWith('\n'))
+            text = text.slice(0, -1);
+        // Triple-clicking ONE blank line hands back "\n": after the strip the body
+        // is empty but a line WAS selected (the footer badge says so) — keep the
+        // block so the indicator and the badge agree instead of attaching nothing.
+        const block = cappedSelectionBlock(selection.path, text, selection.text !== '');
+        if (block === undefined)
+            return undefined;
+        blocks.push({ type: 'text', text: block.text });
+        return { lines: block.lines, path: selection.path };
+    }
+    if (fs === undefined)
+        return undefined;
+    try {
+        const absolute = isAbsolute(selection.path) ? selection.path : join(cwd, selection.path);
+        const target = await fs.resolve(absolute);
+        const info = await fs.stat(target);
+        if (info?.type !== 'file')
+            return undefined;
+        const content = await fs.readText(target);
+        const block = buildSelectionBlock(selection, content);
+        if (block === undefined)
+            return undefined;
+        blocks.push({ type: 'text', text: block.text });
+        return { lines: block.lines, path: selection.path };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Derive the transcript indicator from the DURABLE user-message content:
+ * the `<attached-file path="…" selection count="N">` block the submit path
+ * appended is part of the persisted event, so a replayed session can rebuild
+ * the "Selected N lines from <file>" line even though the in-memory
+ * message-id → attachment map starts empty (maintainer review round 3: the
+ * session log is the source of truth — the indicator must not depend on
+ * process-local state).
+ */
+export function replaySelectionAttachment(content) {
+    if (content === undefined)
+        return undefined;
+    for (const block of content) {
+        if (block === null || typeof block !== 'object')
+            continue;
+        const text = block.text;
+        if (block.type !== 'text' || typeof text !== 'string')
+            continue;
+        const opened = /^<attached-file path="([^"]+)" selection(?: count="(\d+)")?>\n/.exec(text);
+        if (opened === null)
+            continue;
+        let closed = text.slice(opened[0].length);
+        if (closed.endsWith('</attached-file>'))
+            closed = closed.slice(0, -'</attached-file>'.length);
+        // The builder writes `body\n</attached-file>` — strip the newline the
+        // close tag rode on, or every body counts one phantom line.
+        if (closed.endsWith('\n'))
+            closed = closed.slice(0, -1);
+        const lines = closed.split('\n').length;
+        // `count` is authoritative when present (the builder always writes it).
+        // Blocks persisted before it existed fall back to the old tail heuristic,
+        // which misreads a body whose last line is literally the truncation marker.
+        const counted = opened[2] === undefined ? undefined : Number(opened[2]);
+        return {
+            lines: counted ?? (closed.endsWith('\n[… truncated]') ? lines - 1 : lines),
+            // Reverse escapeSnippetAttr so the replayed indicator shows the path
+            // exactly as the live one did (`&` first so entities are not re-baked).
+            path: opened[1]
+                .replace(/&lt;/g, '<')
+                .replace(/&gt;/g, '>')
+                .replace(/&quot;/g, '"')
+                .replace(/&amp;/g, '&'),
+        };
+    }
+    return undefined;
+}
+/**
+ * Bounded map from a submitted message id → what its selection attached.
+ * The delivery path remembers at submit; the transcript projection reads it
+ * when the durable `user/message` event lands (the event carries the same
+ * message id) to stamp the row's indicator. FIFO-capped like the other
+ * row-keyed caches — ids grow monotonically and a miss only loses the
+ * indicator, never the attachment itself.
+ */
+export function createSelectionAttachments() {
+    const byMessageId = new Map();
+    return {
+        remember(messageId, info) {
+            byMessageId.set(messageId, info);
+            while (byMessageId.size > 128) {
+                const oldest = byMessageId.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                byMessageId.delete(oldest);
+            }
+        },
+        take(messageId) {
+            return byMessageId.get(messageId);
+        },
+    };
+}

package/lib/types/dsh-adapter/channel/input-actions.d.ts

@@ -0,0 +1,13 @@
+/** Input actions own cancellation/requeue convergence, not session binding. */
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ChannelState, ComposerImageRef } from './types.js';
+export interface InputConvergence {
+    cancelInFlight: boolean;
+    interruptSeq: number;
+}
+export declare function createInputActions(getState: () => Pick<ChannelState, 'agentId' | 'pending' | 'cancelPending' | 'emit' | 'notify'>, getAgent: () => Agent, owner: {
+    assertActive(): void;
+}, input: InputConvergence, composer: {
+    includeLegacyImageRefs(text: string, images: readonly ComposerImageRef[]): readonly ComposerImageRef[];
+}, dispatchUserText: (text: string, placement: 'steer' | 'followup', images?: readonly ComposerImageRef[]) => void, runLocalCommand: (command: string, includeInContext: boolean) => Promise<void>): Pick<ChannelState, 'submit' | 'steer' | 'removePending' | 'cancel' | 'interruptAndDeliver'>;
+//# sourceMappingURL=input-actions.d.ts.map

package/lib/types/dsh-adapter/channel/input-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-actions.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/input-actions.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAInD,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAA;AAEpF,MAAM,WAAW,gBAAgB;IAAG,cAAc,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACnF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC,EAC/F,QAAQ,EAAE,MAAM,KAAK,EACrB,KAAK,EAAE;IAAE,YAAY,IAAI,IAAI,CAAA;CAAE,EAC/B,KAAK,EAAE,gBAAgB,EACvB,QAAQ,EAAE;IAAE,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAAA;CAAE,EACpH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,gBAAgB,EAAE,KAAK,IAAI,EAC/G,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAC7E,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,OAAO,GAAG,eAAe,GAAG,QAAQ,GAAG,qBAAqB,CAAC,CAgI7F"}