@deepseek-ai/dsh-app-boot 0.1.7-alpha.1 → 0.1.7-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md
-README.md: 5bbe75d641eeeaf3b87c31221b3491ad1408934e
-README.zh.md: b3ac89c1cb082880622175b494d540888b19e804
+README.md: 70a8e235ac5846061ea47e79e7dc575881110a50
+README.zh.md: 9849b033e01827a4c50a22b72ea20deebb0fdd85

package/README.md

@@ -40,7 +40,7 @@ installFailLoud('dsh')
 const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT))
 ```
 
-With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution, application endpoints, and Web bootstrap/transport: `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`.
+`installFailLoud` writes one labelled `util.inspect` diagnostic to stderr for an unhandled rejection or an uncaught exception, awaits the surface's release hook under a fixed timeout, and exits 1; control never returns to the failed operation, because only the throw site knows which state is intact, and the event loop runs only until the release settles or times out. With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution, application endpoints, and Web bootstrap/transport: `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`.
 
 <a id="profiles"></a>
 ### Profiles
@@ -97,6 +97,7 @@ After the Loader settles, app-boot warns when only optional entries are inactive
 | An injected service is unavailable | Warn; continue while the entry waits for its dependencies | Stop startup | Keep the entry waiting; adding the missing provider can activate it |
 | HTTP port binding fails | Warn; continue without that endpoint | Stop startup | Keep the process running without the failed endpoint; corrected config can restore it |
 | Detached asynchronous work outside the `apply()` return Promise produces an unhandled rejection | Fatal: dispose the app and exit nonzero | Fatal: dispose the app and exit nonzero | Fatal: dispose the app and exit nonzero, regardless of entry id |
+| A synchronous callback (a stream `'data'` listener, a timer) throws an uncaught exception at any point in the process lifetime | Fatal: dispose the app and exit nonzero; the failed operation is not resumed | Fatal: dispose the app and exit nonzero; the failed operation is not resumed | Fatal: dispose the app and exit nonzero, regardless of entry id |
 | Entry is absent or explicitly disabled | Ignore it | Ignore it | Do not activate it; no required-startup audit |
 
 The required list above includes `modules` and `connection`; Web startup cannot succeed when either enabled entry fails. Failure of an optional provider can also prevent a required consumer from activating. Schema rejection before an existing entry updates is not a transactional rollback of sibling changes.

package/README.zh.md

@@ -40,7 +40,7 @@ installFailLoud('dsh')
 const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT))
 ```
 
-有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行、应用 endpoint，以及 Web 启动与传输：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。
+`installFailLoud` 会为未处理 rejection 或未捕获异常向 stderr 写一条带标签的 `util.inspect` 诊断，在固定超时内等待界面的 release 钩子，然后以 1 退出；控制流不会回到失败的操作，因为只有抛出点知道哪些状态仍然完整，事件循环只运行到 release 结束或超时。有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行、应用 endpoint，以及 Web 启动与传输：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。
 
 <a id="profiles"></a>
 ### Profile
@@ -97,6 +97,7 @@ Loader 结算后，app-boot 在仅 optional 条目未激活时输出警告。如
 | 注入的服务不可用 | 警告；继续，条目等待依赖 | 终止启动 | 条目继续等待；补上缺失的提供方后可以激活 |
 | HTTP 端口绑定失败 | 警告；继续，但该端点不可用 | 终止启动 | 进程继续运行，但失败的端点不可用；修正配置后可以恢复 |
 | 脱离 `apply()` 返回 Promise 的异步任务产生未处理 rejection | 致命错误：释放应用并以非零码退出 | 致命错误：释放应用并以非零码退出 | 致命错误：释放应用并以非零码退出，与条目 id 无关 |
+| 同步回调（流的 `'data'` 监听器、定时器）在进程生命周期任一时刻抛出未捕获异常 | 致命错误：释放应用并以非零码退出；失败的操作不会被恢复 | 致命错误：释放应用并以非零码退出；失败的操作不会被恢复 | 致命错误：释放应用并以非零码退出，与条目 id 无关 |
 | 条目缺失或被显式禁用 | 忽略 | 忽略 | 不激活该条目；不执行 required 启动审计 |
 
 上面的 required 列表包含 `modules` 与 `connection`；只要其中一个已启用条目失败，Web 就无法成功启动。Optional 提供方失败也可能使 required 消费方无法激活。现有条目的新配置在更新前被 schema 校验拒绝，并不等于对兄弟插件的变更做事务回滚。

package/lib/index.js

@@ -1,7 +1,7 @@
 import { createRequire, isBuiltin } from "node:module";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { parseEnv } from "node:util";
+import { inspect, parseEnv } from "node:util";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import * as yaml from "js-yaml";
 import { Context, Service } from "@deepseek-ai/cordis";
@@ -3363,11 +3363,22 @@ async function observeLoaderRejectionCheckpoint(reasons) {
 */
 const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2e3;
 /**
-* Install before boot to turn a late unhandled plugin-init rejection into one
-* labelled stderr diagnostic and `exit(1)`. A rejection already included by
-* {@link auditStartupEntries} is ignored during its process checkpoint;
-* every other rejection remains fatal. Stdout remains untouched for ACP; the
-* returned function removes the handler.
+* Install before boot to turn an unhandled rejection or an uncaught exception,
+* at any point in the process lifetime, into one labelled stderr diagnostic and
+* `exit(1)`. A rejection already included by {@link auditStartupEntries} is
+* ignored during its process checkpoint; every other rejection and every
+* uncaught exception remains fatal. Control never returns to the failed
+* operation after either: only the throw site knows which state is intact, and
+* a listener that threw mid-update (a stream `'data'` handler, a half-applied
+* registry write) leaves silently wrong results behind if it were resumed. The
+* event loop keeps running only until the release hook settles or times out.
+* Stdout remains untouched for ACP; the returned function removes both handlers.
+*
+* The diagnostic is `util.inspect(err)`, not `err.stack`: a `node:fs` error's
+* `code`, `syscall`, and `path` and any `cause` chain are enumerable properties
+* that the stack line omits, and they are what a crash report needs. Once a
+* handler is installed Node prints nothing of its own, so this line is the
+* only record of the failure.
 *
 * The Loader mounts entries concurrently, so a surface that owns the terminal
 * can already hold it when a sibling entry rejects. Exiting straight from the
@@ -3389,15 +3400,17 @@ const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2e3;
 * @param release - optional teardown awaited before exit, used by a
 *   terminal-owning surface to restore the terminal. Its own failure is
 *   swallowed because the pending fatal exit already owns the outcome.
-* @returns the uninstaller that removes the rejection handler.
+* @returns the uninstaller that removes both handlers.
 */
 function installFailLoud(binName, proc = process, release) {
 	let exiting = false;
-	const handler = (err) => {
-		if (assembledActivationRejections.has(err)) return;
+	const report = (err, label) => {
 		if (exiting) return;
 		exiting = true;
-		proc.stderr.write(`${binName}: fatal load failure: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+		proc.stderr.write(`${binName}: ${label}: ${inspect(err, {
+			depth: 4,
+			maxArrayLength: 50
+		})}\n`);
 		if (release === void 0) {
 			proc.exit(1);
 			return;
@@ -3413,8 +3426,19 @@ function installFailLoud(binName, proc = process, release) {
 			proc.exit(1);
 		})();
 	};
-	const uninstall = () => void proc.off("unhandledRejection", handler);
-	proc.on("unhandledRejection", handler);
+	const onRejection = (err) => {
+		if (assembledActivationRejections.has(err)) return;
+		report(err, "fatal load failure");
+	};
+	const onException = (err) => {
+		report(err, "fatal uncaught exception");
+	};
+	const uninstall = () => {
+		proc.off("unhandledRejection", onRejection);
+		proc.off("uncaughtException", onException);
+	};
+	proc.on("unhandledRejection", onRejection);
+	proc.on("uncaughtException", onException);
 	return uninstall;
 }
 /**

package/lib/types/index.d.ts

@@ -144,13 +144,15 @@ export declare function renderConfigDump(binName: string, absoluteConfigPath: st
  * entry creation was in flight.
  */
 export declare function mountRootInclude(ctx: Context, absoluteConfigPath: string, patches?: readonly PatchOptions[], bareModuleBaseUrl?: string): Promise<Entry | undefined>;
+/** The two process events {@link installFailLoud} turns into a fatal exit. */
+export type FailLoudEvent = 'unhandledRejection' | 'uncaughtException';
 /**
  * The slice of `process` {@link installFailLoud} needs — injectable so tests
  * exercise the handler without registering on (or exiting) the real process.
  */
 export interface FailLoudProcess {
-    on(event: 'unhandledRejection', handler: (err: unknown) => void): unknown;
-    off(event: 'unhandledRejection', handler: (err: unknown) => void): unknown;
+    on(event: FailLoudEvent, handler: (err: unknown) => void): unknown;
+    off(event: FailLoudEvent, handler: (err: unknown) => void): unknown;
     stderr: {
         write(chunk: string): unknown;
     };
@@ -167,11 +169,22 @@ export interface FailLoudProcess {
  */
 export declare const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2000;
 /**
- * Install before boot to turn a late unhandled plugin-init rejection into one
- * labelled stderr diagnostic and `exit(1)`. A rejection already included by
- * {@link auditStartupEntries} is ignored during its process checkpoint;
- * every other rejection remains fatal. Stdout remains untouched for ACP; the
- * returned function removes the handler.
+ * Install before boot to turn an unhandled rejection or an uncaught exception,
+ * at any point in the process lifetime, into one labelled stderr diagnostic and
+ * `exit(1)`. A rejection already included by {@link auditStartupEntries} is
+ * ignored during its process checkpoint; every other rejection and every
+ * uncaught exception remains fatal. Control never returns to the failed
+ * operation after either: only the throw site knows which state is intact, and
+ * a listener that threw mid-update (a stream `'data'` handler, a half-applied
+ * registry write) leaves silently wrong results behind if it were resumed. The
+ * event loop keeps running only until the release hook settles or times out.
+ * Stdout remains untouched for ACP; the returned function removes both handlers.
+ *
+ * The diagnostic is `util.inspect(err)`, not `err.stack`: a `node:fs` error's
+ * `code`, `syscall`, and `path` and any `cause` chain are enumerable properties
+ * that the stack line omits, and they are what a crash report needs. Once a
+ * handler is installed Node prints nothing of its own, so this line is the
+ * only record of the failure.
  *
  * The Loader mounts entries concurrently, so a surface that owns the terminal
  * can already hold it when a sibling entry rejects. Exiting straight from the
@@ -193,7 +206,7 @@ export declare const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2000;
  * @param release - optional teardown awaited before exit, used by a
  *   terminal-owning surface to restore the terminal. Its own failure is
  *   swallowed because the pending fatal exit already owns the outcome.
- * @returns the uninstaller that removes the rejection handler.
+ * @returns the uninstaller that removes both handlers.
  */
 export declare function installFailLoud(binName: string, proc?: FailLoudProcess, release?: () => Promise<void> | void): () => void;
 interface InactiveEntry {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-app-boot",
   "description": "Shared boot glue for the app bins: .env loading, fail-loud Loader guards, snapshot-aware config resolution, and the Loader boot sequence",
-  "version": "0.1.7-alpha.1",
+  "version": "0.1.7-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -37,27 +37,27 @@
     "js-yaml": "^4.2.0",
     "node-addon-require-builtin": "^0.1.6",
     "resolve.exports": "^2.0.3",
-    "@deepseek-ai/dsh-package-manifest": "^0.1.7-alpha.1"
+    "@deepseek-ai/dsh-package-manifest": "0.1.7-alpha.2"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis-plugin-include": "^1.0.8",
-    "@deepseek-ai/cordis-plugin-group": "^1.0.3",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis": "^4.0.3",
-    "@deepseek-ai/dsh-home-paths": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.4"
+    "@deepseek-ai/cordis-plugin-group": "~1.0.4",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.9",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.4"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@deepseek-ai/schemastery": "^3.18.3",
-    "@deepseek-ai/cordis-plugin-group": "^1.0.3",
-    "@deepseek-ai/cordis-plugin-include": "^1.0.8",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis-plugin-timer": "^1.1.5",
-    "@deepseek-ai/dsh-home-paths": "^0.1.7-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.1",
-    "@deepseek-ai/cordis": "^4.0.3"
+    "@deepseek-ai/schemastery": "~3.18.4",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.9",
+    "@deepseek-ai/cordis-plugin-group": "~1.0.4",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.6",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
+    "@deepseek-ai/dsh-home-paths": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.4"
   }
 }