@chatcode/chatcode-cli 3.0.3 → 3.0.4-rc.2

package/runtime/node_modules/@deepseek-ai/dsh-session-persistence-jsonl/lib/index.js

@@ -2,7 +2,7 @@ import z from "@deepseek-ai/schemastery";
 import { SessionFormatUnsupportedMigrationError, createSessionFormatCatalogWithChildren, historicalSessionFormatCatalog, sessionFormatCatalog } from "@deepseek-ai/dsh-session-format-catalog";
 import { readdirSync } from "node:fs";
 import { link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, stat, truncate } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, parse, resolve, toNamespacedPath } from "node:path";
+import { basename, dirname, isAbsolute, join, parse, resolve, sep, toNamespacedPath } from "node:path";
 import { performance } from "node:perf_hooks";
 import { scheduler } from "node:timers/promises";
 import { createHash, randomBytes } from "node:crypto";
@@ -2282,6 +2282,8 @@ async function prepareCatalogFacts(parentId, sources, compression, signal) {
 * log, so the memo only needs the sessions in flight between those steps.
 */
 const COLD_LOG_MEMO_MAX_ENTRIES = 2;
+/** Retained with the stable lock inode after payload deletion. Contains no conversation data. */
+const DELETED_FILENAME = ".deleted";
 const DEFAULT_COMPRESSION = "zstd";
 /**
 * Internal scheduling constant, not deployment configuration: balance
@@ -2434,6 +2436,7 @@ var JsonlSessionPersistence = class extends SessionPersistence {
 		toHeaderLine(snapshot, options?.inheritedEventCount);
 		const inheritedEventCount = SessionLogOffset(options?.inheritedEventCount ?? 0);
 		await this.ensureRootEncoding();
+		if (await this.wasDeleted(header.id)) throw new SessionAlreadyExistsError(header.id);
 		options?.signal?.throwIfAborted();
 		if (this.tracker.hasPending(snapshot.id) || await this.findLog(snapshot.id, options?.signal) !== void 0) throw new SessionAlreadyExistsError(snapshot.id);
 		options?.signal?.throwIfAborted();
@@ -2596,6 +2599,88 @@ var JsonlSessionPersistence = class extends SessionPersistence {
 		signal?.throwIfAborted();
 		return snapshots;
 	}
+	async prepareDeletion(sessionIds) {
+		const claimed = [];
+		const held = [];
+		let closed = false;
+		const release = async () => {
+			if (closed) return;
+			closed = true;
+			try {
+				const failures = (await Promise.allSettled(held.map((item) => item.lease.release()))).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+				if (failures.length > 0) throw new AggregateError(failures, "Session deletion lock release failed");
+			} finally {
+				for (const id of claimed) this.tracker.releaseClaim(id);
+			}
+		};
+		try {
+			await this.ensureRootEncoding();
+			const root = await realpath(this.root).catch((error) => {
+				if (isENOENT(error)) return this.root;
+				throw error;
+			});
+			for (const id of [...new Set(sessionIds)].sort()) {
+				this.tracker.claimWrite(id);
+				claimed.push(id);
+				await this.stat(id);
+				for (const project of await this.listProjectDirs()) {
+					const dir = join(project, encodeSegment(id));
+					const info = await lstat(dir).catch((error) => {
+						if (isENOENT(error)) return void 0;
+						throw error;
+					});
+					if (info === void 0) continue;
+					if (!info.isDirectory()) throw new Error("Session deletion requires an owned directory");
+					const resolved = await realpath(dir).catch((error) => {
+						if (isENOENT(error)) return void 0;
+						throw error;
+					});
+					if (resolved === void 0) continue;
+					if (!resolved.startsWith(root + sep)) throw new Error("Session deletion path escapes its storage root");
+					held.push({
+						dir,
+						lease: await SessionWriteLease.acquire(dir, id)
+					});
+				}
+			}
+			return {
+				commit: async () => {
+					if (closed) throw new Error("Session deletion reservation is closed");
+					for (const { dir } of held) {
+						const marker = await open(join(dir, DELETED_FILENAME), "a", 384);
+						try {
+							await marker.sync();
+						} finally {
+							await marker.close();
+						}
+						await this.syncDirPosix(dir);
+						for (const entry of await readdir(dir)) if (entry !== "session.lock" && entry !== DELETED_FILENAME) await rm(join(dir, entry), {
+							recursive: true,
+							force: true
+						});
+						await this.syncDirPosix(dir);
+					}
+					for (const id of claimed) {
+						this.coldLogMemo.delete(id);
+						this.migrationPreparations.delete(id);
+					}
+				},
+				[Symbol.asyncDispose]: release
+			};
+		} catch (error) {
+			await release();
+			throw error;
+		}
+	}
+	async wasDeleted(id) {
+		for (const project of await this.listProjectDirs()) try {
+			await stat(join(project, encodeSegment(id), DELETED_FILENAME));
+			return true;
+		} catch (error) {
+			if (!isENOENT(error)) throw error;
+		}
+		return false;
+	}
 	/** Resolve and read one stored log, refusing loudly when the artifact is absent. */
 	async requireStoredLog(id, signal) {
 		const selected = await this.findLog(id, signal);
@@ -2931,7 +3016,14 @@ var JsonlSessionPersistence = class extends SessionPersistence {
 	*/
 	async acquireWriteLease(header) {
 		await this.rejectOppositeArtifact(header.cwd, header.id);
-		return this.acquireLease(header.id, header.cwd);
+		const lease = await this.acquireLease(header.id, header.cwd);
+		try {
+			if (await this.wasDeleted(header.id)) throw new SessionAlreadyExistsError(header.id);
+			return lease;
+		} catch (error) {
+			await lease.release();
+			throw error;
+		}
 	}
 	/** Decode complete frames and retain complete JSONL records from a torn final frame. */
 	async readZstdPrefix(buffer, signal) {
@@ -3334,6 +3426,7 @@ var JsonlSessionPersistence = class extends SessionPersistence {
 			throw error;
 		}
 		signal?.throwIfAborted();
+		if (entries.some((entry) => entry.name === DELETED_FILENAME)) return void 0;
 		const generations = [];
 		const opposite = [];
 		for (const entry of entries) {

package/runtime/node_modules/@deepseek-ai/dsh-session-persistence-jsonl/lib/types/index.d.ts

@@ -7,7 +7,7 @@
  */
 import { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
-import { SessionPersistence, type SessionAccess, type SessionHandle, type SessionHandleReadResult, type SessionPersistenceCreateOptions, type SessionPersistenceListOptions, type SessionPersistenceOpenOptions, type SessionPersistenceSnapshot, type SessionPersistenceStatOptions, type SessionPersistenceRevision as PersistenceRevision } from '@deepseek-ai/dsh-session-persistence';
+import { SessionPersistence, type SessionAccess, type SessionHandle, type SessionDeletion, type SessionHandleReadResult, type SessionPersistenceCreateOptions, type SessionPersistenceListOptions, type SessionPersistenceOpenOptions, type SessionPersistenceSnapshot, type SessionPersistenceStatOptions, type SessionPersistenceRevision as PersistenceRevision } from '@deepseek-ai/dsh-session-persistence';
 import { JsonlSessionHandle } from './storage.ts';
 import { SessionWriteLease } from './lease.ts';
 import type { SessionEvent, SessionId, SessionHeader, SessionLogOffset as SessionLogOffsetType } from '@deepseek-ai/dsh-session';
@@ -118,6 +118,8 @@ declare class JsonlSessionPersistence extends SessionPersistence {
      * @returns one snapshot per session, in no promised order.
      */
     list(options?: SessionPersistenceListOptions): Promise<readonly SessionPersistenceSnapshot[]>;
+    prepareDeletion(sessionIds: readonly SessionId[]): Promise<SessionDeletion>;
+    private wasDeleted;
     /** Resolve and read one stored log, refusing loudly when the artifact is absent. */
     private requireStoredLog;
     /** Probe the memo and otherwise decode one historical generation under backend cancellation. */

package/runtime/node_modules/@deepseek-ai/dsh-session-projection-cache/lib/index.js

@@ -155,6 +155,7 @@ var SessionProjectionCache = class extends Service {
 	listingTable;
 	writes = Promise.resolve();
 	closed = false;
+	deleted = /* @__PURE__ */ new Set();
 	dirty = /* @__PURE__ */ new Map();
 	constructor(ctx, config) {
 		super(ctx, "sessionProjectionCache");
@@ -173,6 +174,24 @@ var SessionProjectionCache = class extends Service {
 			await this.writes;
 		}, "sessionProjectionCache.writeDrain");
 		this.installWritePath();
+		const cleanup = (ids) => {
+			for (const id of ids) this.deleted.add(id);
+			return this.enqueueWrite(async () => {
+				for (const id of ids) {
+					await this.requireTable().delete(id);
+					await this.requireListingTable().delete(id);
+				}
+			});
+		};
+		this.ctx.on("session/deleting", ({ sessionIds }) => cleanup(sessionIds));
+		this.ctx.on("session/deleted", (ids) => {
+			cleanup(ids).catch((error) => {
+				this.ctx.logger.warn(`session projection cache: deletion cleanup failed: ${String(error)}`);
+			});
+		});
+		this.ctx.inject(["workspaceRegistry"], async (ctx) => {
+			await cleanup(ctx.workspaceRegistry.deletedSessionIds);
+		});
 	}
 	/**
 	* The stored record for one session, accepted only when its bound log
@@ -185,6 +204,7 @@ var SessionProjectionCache = class extends Service {
 	* @returns the identity-matching record, or `undefined` (absent or unrelated).
 	*/
 	async recordFor(id, expected) {
+		if (this.deleted.has(id)) return void 0;
 		const record = await this.requireTable().read(id);
 		if (record === void 0) return void 0;
 		return identityMatches(record.identity, expected) ? record : void 0;
@@ -240,14 +260,17 @@ var SessionProjectionCache = class extends Service {
 	/** Read a small listing record, deriving it once from an older full checkpoint when needed. */
 	async listingRecord(id) {
 		await this.writes;
+		if (this.deleted.has(id)) return void 0;
 		const signature = this.ctx.sessionProjections.checkpointViewSignature();
 		const stored = await this.requireListingTable().read(id);
 		if (stored?.signature === signature) return stored.checkpoint;
+		if (this.deleted.has(id)) return void 0;
 		const record = await this.requireTable().read(id);
 		if (record === void 0) return void 0;
 		const listing = this.listingOf(record, signature);
 		await this.enqueueWrite(async () => {
-			if (await this.requireTable().read(id) === record) await this.requireListingTable().put(id, listing);
+			const current = await this.requireTable().read(id);
+			if (!this.deleted.has(id) && current === record) await this.requireListingTable().put(id, listing);
 		}).catch((error) => {
 			this.ctx.logger.warn(`session projection cache: listing write-back for "${id}" failed: ${String(error)}`);
 		});
@@ -402,6 +425,7 @@ var SessionProjectionCache = class extends Service {
 			rows: detached
 		};
 		await this.enqueueWrite(async () => {
+			if (this.deleted.has(id)) return;
 			await this.requireTable().put(id, record);
 			const listing = this.listingOf(record, this.ctx.sessionProjections.checkpointViewSignature());
 			await this.requireListingTable().put(id, listing);

package/runtime/node_modules/@deepseek-ai/dsh-session-projection-cache/lib/types/index.d.ts

@@ -57,6 +57,7 @@ export declare class SessionProjectionCache extends Service {
     private listingTable?;
     private writes;
     private closed;
+    private readonly deleted;
     private readonly dirty;
     constructor(ctx: Context, config: Config);
     /** Open both on-demand domains and install the write-behind listeners. */

package/runtime/node_modules/@deepseek-ai/dsh-session-projection-cache/package.json

@@ -45,6 +45,7 @@
     "@deepseek-ai/dsh-session-projection": "workspace:*",
     "@deepseek-ai/dsh-storage": "workspace:*",
     "@deepseek-ai/dsh-storage-domain": "workspace:*",
-    "@deepseek-ai/dsh-storage-json": "workspace:*"
+    "@deepseek-ai/dsh-storage-json": "workspace:*",
+    "@deepseek-ai/dsh-workspace": "workspace:*"
   }
 }

package/runtime/node_modules/@deepseek-ai/dsh-session-query/lib/index.js

@@ -331,6 +331,13 @@ var SessionObservationReader = class {
 	cacheCapacity;
 	cache = /* @__PURE__ */ new Map();
 	/**
+	* Drop deleted identities while existing observation leases settle independently.
+	* @param ids - permanently deleted Session identities.
+	*/
+	forget(ids) {
+		for (const id of ids) this.cache.delete(id);
+	}
+	/**
 	* @param ctx - context carrying Session and optional persistence/projection services.
 	* @param cacheCapacity - maximum unpinned cold observations retained for reuse.
 	*/
@@ -1055,6 +1062,12 @@ var SessionQueryEngine = class extends Service {
 		if (!Number.isSafeInteger(preparedSessionCacheSize) || preparedSessionCacheSize < 1) throw new SessionQueryError("session-query: preparedSessionCacheSize must be a positive safe integer", "SESSION_QUERY_INVALID_CONFIG");
 		this._corpus = new SessionCorpus(ctx, persistedReadConcurrency);
 		this._observations = new SessionObservationReader(ctx, preparedSessionCacheSize);
+		ctx.on("session/deleting", ({ sessionIds }) => {
+			this._observations.forget(sessionIds);
+		});
+		ctx.on("session/deleted", (ids) => {
+			this._observations.forget(ids);
+		});
 	}
 	/**
 	* Observe one exact live or prepared Session without a persistence listing preflight.

package/runtime/node_modules/@deepseek-ai/dsh-session-query/lib/types/observation.d.ts

@@ -50,6 +50,11 @@ export declare class SessionObservationReader {
     private readonly ctx;
     private readonly cacheCapacity;
     private readonly cache;
+    /**
+     * Drop deleted identities while existing observation leases settle independently.
+     * @param ids - permanently deleted Session identities.
+     */
+    forget(ids: readonly SessionId[]): void;
     /**
      * @param ctx - context carrying Session and optional persistence/projection services.
      * @param cacheCapacity - maximum unpinned cold observations retained for reuse.

package/runtime/node_modules/@deepseek-ai/dsh-session-query-sqlite/lib/index.js

@@ -529,6 +529,32 @@ var SqliteSessionQueryEngine = class extends SessionQueryEngine {
 			return () => this._optionalPersistenceFiber.dispose();
 		}, "sessionQuerySqlite.optionalPersistence");
 		ctx.effect(() => async () => this.close(), "sessionQuerySqlite.close");
+		const cleanup = (ids) => this._serialized(void 0, async () => {
+			if (ids.length === 0 || this.config.openAt === "never") return;
+			await this._ensureReady(void 0);
+			const db = this._requireDb();
+			db.exec("BEGIN IMMEDIATE");
+			try {
+				for (const id of ids) {
+					this._deleteSession("persisted", id);
+					this._deleteSession("live", id);
+				}
+				db.exec("COMMIT");
+			} catch (error) {
+				db.exec("ROLLBACK");
+				throw error;
+			}
+			this._globalGeneration += 1;
+		});
+		ctx.on("session/deleting", ({ sessionIds }) => cleanup(sessionIds));
+		ctx.on("session/deleted", (ids) => {
+			cleanup(ids).catch((error) => {
+				ctx.logger.warn(`session query: deletion cleanup failed: ${String(error)}`);
+			});
+		});
+		ctx.inject(["workspaceRegistry"], async (ctx) => {
+			await cleanup(ctx.workspaceRegistry.deletedSessionIds);
+		});
 	}
 	/** Open eagerly only when activation owns the configured readiness boundary. */
 	async [Service.init]() {

package/runtime/node_modules/@deepseek-ai/dsh-session-query-sqlite/package.json

@@ -47,6 +47,7 @@
     "@deepseek-ai/dsh-session-persistence-jsonl": "workspace:*",
     "@deepseek-ai/dsh-session-query": "workspace:*",
     "@deepseek-ai/cordis": "workspace:~",
-    "@deepseek-ai/dsh-session-projection": "workspace:*"
+    "@deepseek-ai/dsh-session-projection": "workspace:*",
+    "@deepseek-ai/dsh-workspace": "workspace:*"
   }
 }

package/runtime/node_modules/@deepseek-ai/dsh-settings/lib/index.js

@@ -402,11 +402,12 @@ var SettingsForms = class extends Service {
 	get documentPath() {
 		return this.ownerContext.configEditor.documentPath;
 	}
-	/** Locate the profile patch for native editing.
-	* @returns The existing profile patch path.
+	/** Locate and materialize the owning patch for native editing.
+	* @param namespace Optional namespace; shared entries resolve to the home-level document.
+	* @returns The existing owning patch path.
 	*/
-	prepareDocument() {
-		return Promise.resolve(this.documentPath);
+	prepareDocument(namespace) {
+		return this.ownerContext.configEditor.prepareDocument(namespace);
 	}
 	/** Read active plugin schemas and their live values.
 	* @param options Redaction required for remote callers.

package/runtime/node_modules/@deepseek-ai/dsh-settings/lib/types/index.d.ts

@@ -85,10 +85,11 @@ export declare class SettingsForms extends Service {
     get writable(): boolean;
     /** Current profile patch shown by the native configuration editor. */
     get documentPath(): string;
-    /** Locate the profile patch for native editing.
-     * @returns The existing profile patch path.
+    /** Locate and materialize the owning patch for native editing.
+     * @param namespace Optional namespace; shared entries resolve to the home-level document.
+     * @returns The existing owning patch path.
      */
-    prepareDocument(): Promise<string>;
+    prepareDocument(namespace?: string): Promise<string>;
     /** Read active plugin schemas and their live values.
      * @param options Redaction required for remote callers.
      * @returns Forms keyed by unique profile entry ids.

package/runtime/node_modules/@deepseek-ai/dsh-settings/lib/types/index.js

@@ -261,10 +261,11 @@ export class SettingsForms extends Service {
     get writable() { return true; }
     /** Current profile patch shown by the native configuration editor. */
     get documentPath() { return this.ownerContext.configEditor.documentPath; }
-    /** Locate the profile patch for native editing.
-     * @returns The existing profile patch path.
+    /** Locate and materialize the owning patch for native editing.
+     * @param namespace Optional namespace; shared entries resolve to the home-level document.
+     * @returns The existing owning patch path.
      */
-    prepareDocument() { return Promise.resolve(this.documentPath); }
+    prepareDocument(namespace) { return this.ownerContext.configEditor.prepareDocument(namespace); }
     /** Read active plugin schemas and their live values.
      * @param options Redaction required for remote callers.
      * @returns Forms keyed by unique profile entry ids.

package/runtime/node_modules/@deepseek-ai/dsh-storage/lib/types/backend.d.ts

@@ -86,6 +86,10 @@ export interface KvUnit {
         tables: Record<string, Record<string, unknown>>;
         global: unknown;
     }>;
+    /** Reload committed medium state before a domain refresh. Unsupported backends retain their snapshot. */
+    refresh?(): Promise<void>;
+    /** Hold a cross-process writer lock across a complete logical operation, including all its writes. */
+    exclusive?<T>(operation: () => Promise<T>): Promise<T>;
     /**
      * Read one record without loading other records. Backends without keyed
      * reads omit this member; on-demand domains require it.

package/runtime/node_modules/@deepseek-ai/dsh-storage-domain/lib/index.js

@@ -1,5 +1,7 @@
 import z from "@deepseek-ai/schemastery";
 import { UNIT_NAME_RE, storageBackendServiceKey } from "@deepseek-ai/dsh-storage";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { isDeepStrictEqual } from "node:util";
 //#region lib/types/error.js
 /**
 * Error vocabulary of the domain data form.
@@ -109,6 +111,7 @@ const noop = () => {};
 */
 var DomainImpl = class {
 	ctx;
+	spec;
 	unit;
 	onClosed;
 	/** Domain name from the spec. */
@@ -123,6 +126,7 @@ var DomainImpl = class {
 	/** Set when close finishes (chain drained, unit closed): reads reject from here on. */
 	closed = false;
 	disposal;
+	operationScope = new AsyncLocalStorage();
 	/**
 	* @param ctx - Context that carries `domain/changed` emissions.
 	* @param spec - The domain declaration.
@@ -138,6 +142,7 @@ var DomainImpl = class {
 	*/
 	constructor(ctx, spec, unit, records, globalValue, onClosed, readStored) {
 		this.ctx = ctx;
+		this.spec = spec;
 		this.unit = unit;
 		this.onClosed = onClosed;
 		this.name = spec.name;
@@ -191,6 +196,53 @@ var DomainImpl = class {
 		if (table === void 0) throw new Error(`domain '${this.name}' declares no table '${name}'`);
 		return table;
 	}
+	/** Reload eager records atomically in memory; a malformed record leaves the previous projection untouched.
+	* @returns Whether persisted records or global values changed the in-memory projection.
+	*/
+	refresh() {
+		return this.enqueue(async () => {
+			await this.unit.refresh?.();
+			const snapshot = await this.unit.loadAll();
+			const records = /* @__PURE__ */ new Map();
+			let global;
+			try {
+				for (const [name, tableSpec] of Object.entries(this.spec.tables)) {
+					const parsed = /* @__PURE__ */ new Map();
+					for (const [key, raw] of Object.entries(snapshot.tables[name] ?? {})) parsed.set(key, tableSpec.valueSchema.parse(raw));
+					records.set(name, parsed);
+				}
+				global = this.spec.global === void 0 ? void 0 : snapshot.global === null ? this.spec.global.initial : this.spec.global.schema.parse(snapshot.global);
+			} catch (error) {
+				throw new DomainError("invalid-record", `domain '${this.name}': refreshed snapshot failed validation`, { cause: error });
+			}
+			let changed = !isDeepStrictEqual(this.globalValue, global);
+			for (const [name, next] of records) {
+				const table = this.tables.get(name);
+				if (table === void 0) throw new Error(`domain '${this.name}' declares no table '${name}'`);
+				changed = table.replace(next) || changed;
+			}
+			this.globalValue = global;
+			return changed;
+		});
+	}
+	/** Nested table/global operations run on this queue slot, not behind their own awaiting parent.
+	* @param operation Work executed under the domain queue and backend writer lock.
+	* @returns The operation result after the locked work settles.
+	*/
+	exclusive(operation) {
+		if (this.operationScope.getStore()?.active) return operation();
+		return this.enqueue(async () => {
+			const run = async () => {
+				const scope = { active: true };
+				try {
+					return await this.operationScope.run(scope, operation);
+				} finally {
+					scope.active = false;
+				}
+			};
+			return await (this.unit.exclusive === void 0 ? run() : this.unit.exclusive(run));
+		});
+	}
 	/**
 	* Close this domain: reject new writes immediately, drain already-queued
 	* writes (their events still emit), close the unit, then free the name via
@@ -221,6 +273,7 @@ var DomainImpl = class {
 		}
 	}
 	enqueue(job) {
+		if (this.operationScope.getStore()?.active) return job();
 		if (this.disposing) return Promise.reject(new DomainError("closed", `domain '${this.name}' is closed`));
 		const result = this.chain.then(job);
 		this.chain = result.then(noop, noop);
@@ -241,6 +294,13 @@ var KvTableImpl = class {
 		this.tableName = tableName;
 		this.records = records;
 	}
+	replace(next) {
+		if (isDeepStrictEqual(this.records, next)) return false;
+		this.records.clear();
+		for (const [key, value] of next) this.records.set(key, value);
+		this.loaded.clear();
+		return true;
+	}
 	read(key) {
 		return this.host.enqueue(async () => {
 			if (this.host.readStored !== void 0 && !this.loaded.has(key)) {
@@ -277,9 +337,13 @@ var KvTableImpl = class {
 	}
 	delete(key) {
 		return this.host.enqueue(async () => {
-			if (!this.records.has(key)) return false;
+			if (!(this.records.has(key) || this.host.readStored !== void 0 && await this.host.unit.readRecord(this.tableName, key) !== void 0)) {
+				this.loaded.add(key);
+				return false;
+			}
 			await this.host.unit.deleteRecord(this.tableName, key);
 			this.records.delete(key);
+			this.loaded.add(key);
 			this.host.emitChanged({
 				domain: this.host.domainName,
 				table: this.tableName,

package/runtime/node_modules/@deepseek-ai/dsh-storage-domain/lib/types/domain.d.ts

@@ -94,6 +94,10 @@ export interface Domain<S extends DomainSpec> {
     readonly name: string;
     /** Global singleton handle; a spec without `global` has no usable handle (`never`). */
     readonly global: DomainGlobalHandleOf<S>;
+    /** Reload and validate the complete medium snapshot. No events emit; the owner publishes its refreshed projection. */
+    refresh(): Promise<boolean>;
+    /** Serialize a logical operation locally and, where supported, across processes. Refresh inside the operation before writing. */
+    exclusive<T>(operation: () => Promise<T>): Promise<T>;
     /**
      * Resolve one declared table handle. Handles are stable — repeated calls
      * return the same instance.
@@ -111,8 +115,8 @@ export interface Domain<S extends DomainSpec> {
      */
     close(): Promise<void>;
 }
-/** Keyed reads and complete replacements without whole-table enumeration. */
-export type RecordTable<K extends string, V> = Pick<KvTable<K, V>, 'read' | 'put'>;
+/** Keyed reads, complete replacements, and removals without whole-table enumeration. */
+export type RecordTable<K extends string, V> = Pick<KvTable<K, V>, 'read' | 'put' | 'delete'>;
 /** Per-record domain opened without loading its records. No global slot is exposed. */
 export interface RecordDomain<S extends DomainSpec> {
     /** Domain name from the spec. */
@@ -135,6 +139,7 @@ export interface RecordDomain<S extends DomainSpec> {
  */
 export declare class DomainImpl {
     private readonly ctx;
+    private readonly spec;
     private readonly unit;
     private readonly onClosed;
     /** Domain name from the spec. */
@@ -149,6 +154,7 @@ export declare class DomainImpl {
     /** Set when close finishes (chain drained, unit closed): reads reject from here on. */
     private closed;
     private disposal?;
+    private readonly operationScope;
     /**
      * @param ctx - Context that carries `domain/changed` emissions.
      * @param spec - The domain declaration.
@@ -172,6 +178,15 @@ export declare class DomainImpl {
      * @returns the stable table handle.
      */
     table(name: string): KvTable<string, unknown>;
+    /** Reload eager records atomically in memory; a malformed record leaves the previous projection untouched.
+     * @returns Whether persisted records or global values changed the in-memory projection.
+     */
+    refresh(): Promise<boolean>;
+    /** Nested table/global operations run on this queue slot, not behind their own awaiting parent.
+     * @param operation Work executed under the domain queue and backend writer lock.
+     * @returns The operation result after the locked work settles.
+     */
+    exclusive<T>(operation: () => Promise<T>): Promise<T>;
     /**
      * Close this domain: reject new writes immediately, drain already-queued
      * writes (their events still emit), close the unit, then free the name via

package/runtime/node_modules/@deepseek-ai/dsh-storage-json/lib/index.js

@@ -3,6 +3,7 @@ import z from "@deepseek-ai/schemastery";
 import { StorageError, UNIT_NAME_RE, storageBackendServiceKey } from "@deepseek-ai/dsh-storage";
 import { dirname, join } from "node:path";
 import { randomUUID } from "node:crypto";
+import { withFileLock } from "@deepseek-ai/dsh-atomic-write";
 //#region lib/types/atomic.js
 /**
 * Atomic whole-file replacement for the JSON backend.
@@ -203,6 +204,30 @@ var SingleJsonUnit = class {
 		this.state = state;
 		this.onClose = onClose;
 	}
+	async refresh() {
+		this.assertOpen();
+		let text;
+		try {
+			text = await readFile(this.path, "utf8");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		this.state = text === void 0 ? {
+			version: this.descriptor.version,
+			global: null,
+			tables: new Map(this.descriptor.tables.map((table) => [table, /* @__PURE__ */ new Map()]))
+		} : parse(text, this.descriptor);
+	}
+	async exclusive(operation) {
+		this.assertOpen();
+		const pending = withFileLock(this.path, operation, { waitMs: 1e4 });
+		this.inFlight.add(pending);
+		try {
+			return await pending;
+		} finally {
+			this.inFlight.delete(pending);
+		}
+	}
 	async loadAll() {
 		this.assertOpen();
 		const tables = {};

package/runtime/node_modules/@deepseek-ai/dsh-storage-json/package.json

@@ -31,6 +31,7 @@
     "@deepseek-ai/cordis": "workspace:~"
   },
   "dependencies": {
+    "@deepseek-ai/dsh-atomic-write": "workspace:*",
     "@deepseek-ai/schemastery": "workspace:~"
   },
   "devDependencies": {

package/runtime/node_modules/@deepseek-ai/dsh-subagent/lib/types/control.d.ts

@@ -12,8 +12,8 @@ declare const CONTROL_ID_SCHEMAS: {
         childSessionId: z.ZodString;
         mode: z.ZodLiteral<"continuable">;
         delivery: z.ZodEnum<{
-            steer: "steer";
             queue: "queue";
+            steer: "steer";
         }>;
     }, z.core.$strip>;
     readonly 'subagent.interrupt': z.ZodObject<{