@deepseek-ai/dsh-client-test-runtime 0.2.1-alpha.2 → 0.2.1-alpha.4

package/README.i18n.yaml

@@ -18,8 +18,8 @@
   en: 12afbb217bc06678
   zh: c07f001ed8bb3300
 /deepseek-ai-dsh-client-test-runtime/use-this-package/setting-up-a-feature-spec:
-  en: e78bc5e3adf2ff44
-  zh: 480cd66637d92047
+  en: 620906bcbaba405a
+  zh: b7c34920ba5873d1
 /deepseek-ai-dsh-client-test-runtime/use-this-package/local-dom-snapshots:
   en: 1abbbed6cc4cf57b
   zh: ab3975178b589653
@@ -30,8 +30,8 @@
   en: 1442fc215c8128e8
   zh: 8439861b08e46ea2
 /deepseek-ai-dsh-client-test-runtime/use-this-package/roster-and-startup-behavior:
-  en: 964236f295b61c0c
-  zh: 863a9342b1169ad8
+  en: 95c5c2121547bd60
+  zh: 4dfb089ba7aac04d
 /deepseek-ai-dsh-client-test-runtime/use-this-package/when-to-use-it:
   en: eb2f9bc90acb7a62
   zh: cb59a2134bc83106
@@ -45,8 +45,8 @@
   en: 3264640018c1a0e8
   zh: d777e0b8ad8b602f
 /deepseek-ai-dsh-client-test-runtime/understand-the-implementation/source-map:
-  en: b77fd15bc12265db
-  zh: 1a14b6999978b72a
+  en: e3ef8397426d484b
+  zh: 23f735f4bda1534a
 /deepseek-ai-dsh-client-test-runtime/understand-the-implementation/lifecycle:
   en: b42779f364504719
   zh: a10bad7ea1161388

package/README.md

@@ -44,6 +44,8 @@ await runtime.dispose()
 
 `mount` prechecks required services and fails loud when one is missing — `provide(name, value)` supplies an extra service first. The runtime provides a `fileUpload` stub that rejects every call until a suite replaces `runtime.fileUpload.upload`. `storeOf(key, scopeKey)` returns the live store instance the renderer hands a slot's component for identity and action-driven-write assertions.
 
+The runtime installs `allowAllAccessPlugin` before ui-session: its `remoteAccess` service answers true for every resource, so every access Hook allows every action. Hand-built component props spread `...allowAllAccess` to receive the same Hooks; a spec of a refused path overrides one Hook.
+
 The optional render options select a keyed entry with `entryKey` or a list item with `only`; `view.update(owner)` retains that selection. `runtime.panelInfo` supplies the default `usePanelInfo` source with no global panel selected. Release it with `releasePanelInfoSource()` before mounting the production Layout owner. `dispose()` releases both default Workspace and panel-info root sources; early release is idempotent and does not remove replacement owners.
 
 The Session fixture resolves subagent addresses from explicitly supplied addresses or loaded parent projections without retaining a Session generation. External catalog entries have no local browsing address.
@@ -91,7 +93,7 @@ The [generic Remote proxy](../remote-mock/README.md#remote-proxy) supports every
 
 ### Roster and startup behavior
 
-`webApp` is the `web` profile's browser roster, read when the assembly entry is first imported from its bundles (`dsh-base`, then `dsh-web-app`) as the launcher composes them, except that a patch matching nothing throws here where the launcher warns: each bundle's `dsh.bundle.patch` list is parsed with the include plugin's YAML dialect and composed by its `applyEntryPatches`, and every enabled row whose package declares `dsh.client.platform === 'web'` becomes a row carrying that declaration's `inject` and `immediately`; `bundleRoster(bundles, anchor, disabledContext)` accepts an explicit Loader evaluation scope for conditional `disabled` flags; without one, browser expressions are rejected. `webApp` supplies the Web profile name, not business Host services. Nothing is copied from the bundles, so a bundle change is visible at the next test run. `webApp.closure(names)` keeps the named rows plus everything they inject, transitively (the rows a spec needs to boot those plugins as the bundle composes them), `webApp.pick(names)` and `webApp.without(names)` cut it down by hand, all three throw on unknown names, and `ClientRoster.of(rows)` builds one inline. `remoteDefaultResponses` holds default responses for exactly the Remote endpoints the roster calls while booting with no sessions, no workspaces, and default settings; a spec layers its own `RemoteTable` on top with `mock.load(table)`, and any call without a rule fails the test at `dispose()` through `mock.assertNoUnmatched()`. `mount` requires a roster that provides `uiRenderer`; `start` fails loud otherwise instead of returning an empty container. `client.connection` is the roster's Connection service (no `Context` augmentation declares it), and `connectTimeoutMs` bounds the readiness wait, whose failure message lists the mock log. `reload(name)` rebuilds one Loader entry through the shared Client Modules helper (registry-first teardown, then `entry.refresh()`); each client retains its own module system and instance-bound Connection replacement, so starts and reloads can overlap without changing a page global. `unload(name)` removes an entry and waits for plugin cleanup; `flush()` settles React inside `act`. jsdom implements neither `EventSource` (client-hmr opens one at apply) nor `ResizeObserver` nor the `document.fonts` event target (layout components observe size and font loading at mount), so `start` reference-counts inert stubs for whichever global is absent and `dispose` removes exactly those — a jsdom gap, not a client identity channel. The `@deepseek-ai/dsh-api-remotes` row is dropped from every roster: its generated Remote clients exist only in built `lib/`, and `remote.<ns>` is what the tier replaces anyway. `start` instead provides one contract-free proxy per `remote.<ns>` service the roster injects (plus the namespaces the mock has rules for at that point; a namespace first registered later has no proxy); `ctx.remote.<ns>.<method>(...args)` becomes a call on the endpoint `<ns>/<method>` carrying the positional args, a stream when the mock registered a `stream()` script and a unary call otherwise, with the generated client's outcome folding (`gateway/internal` for carrier throws, `gateway/cancelled` on abort). An endpoint without a rule is still dispatched, so the mock logs it and `dispose()` fails the test.
+`webApp` is the `web` profile's browser roster, read when the assembly entry is first imported from its bundles (`dsh-base`, then `dsh-web-app`) as the launcher composes them, except that a patch matching nothing throws here where the launcher warns: each bundle's `dsh.bundle.patch` list is parsed with the include plugin's YAML dialect and composed by its `applyEntryPatches`, and every enabled row whose package declares `dsh.client.platform === 'web'` becomes a row carrying that declaration's `inject` and `immediately`; `bundleRoster(bundles, anchor, disabledContext)` accepts an explicit Loader evaluation scope for conditional `disabled` flags; without one, browser expressions are rejected. `webApp` supplies the Web profile name, not business Host services. Nothing is copied from the bundles, so a bundle change is visible at the next test run. `webApp.closure(names)` keeps the named rows plus everything they inject, transitively (the rows a spec needs to boot those plugins as the bundle composes them), `webApp.pick(names)` and `webApp.without(names)` cut it down by hand, all three throw on unknown names, and `ClientRoster.of(rows)` builds one inline. `remoteDefaultResponses` holds default responses for exactly the Remote endpoints the roster calls while booting with no sessions, no workspaces, and default settings; a spec layers its own `RemoteTable` on top with `mock.load(table)`, and any call without a rule fails the test at `dispose()` through `mock.assertNoUnmatched()`. `mount` requires a roster that provides `uiRenderer`; `start` fails loud otherwise instead of returning an empty container. `client.connection` is the roster's Connection service (no `Context` augmentation declares it), and `connectTimeoutMs` bounds the readiness wait, whose failure message lists the mock log. `reload(name)` rebuilds one Loader entry through the shared Client Modules helper (registry-first teardown, then `entry.refresh()`); each client retains its own module system and instance-bound Connection replacement, so starts and reloads can overlap without changing a page global. `unload(name)` removes an entry and waits for plugin cleanup; `flush()` settles React inside `act`. jsdom implements neither `EventSource` (client-hmr opens one at apply) nor `ResizeObserver` nor the `document.fonts` event target (layout components observe size and font loading at mount), so `start` reference-counts inert stubs for whichever global is absent and `dispose` removes exactly those — a jsdom gap, not a client identity channel. The `@deepseek-ai/dsh-api-remotes` row is dropped from every roster: its generated Remote clients exist only in built `lib/`, and `remote.<ns>` is what the tier replaces anyway. The `@deepseek-ai/dsh-api-remote-access` row, which mounts its own generated contribution, is dropped too, and `start` installs `allowAllAccessPlugin` in its place; a plan `provide` entry for either row is refused. `start` instead provides one contract-free proxy per `remote.<ns>` service the roster injects (plus the namespaces the mock has rules for at that point; a namespace first registered later has no proxy); `ctx.remote.<ns>.<method>(...args)` becomes a call on the endpoint `<ns>/<method>` carrying the positional args, a stream when the mock registered a `stream()` script and a unary call otherwise, with the generated client's outcome folding (`gateway/internal` for carrier throws, `gateway/cancelled` on abort). An endpoint without a rule is still dispatched, so the mock logs it and `dispose()` fails the test.
 
 ### When to use it
 
@@ -125,6 +127,7 @@ The bench copies no production logic: it mounts the production `SlotRegistry`, p
 | [`src/sessions.ts`](src/sessions.ts) + [`src/workspaces.ts`](src/workspaces.ts) | `ISessions`/`IWorkspaces` test doubles and `FixtureSession` behavior stubs |
 | [`src/fixtures.ts`](src/fixtures.ts) | Plain fixture builders: conversation snapshots, workspace list state |
 | [`src/snapshot.ts`](src/snapshot.ts) | DOM snapshot serializer (class-hash folding, `<svg>` fingerprint) |
+| [`src/access.ts`](src/access.ts) | `allowAllAccess` props and `allowAllAccessPlugin`, the allow-all stand-in for the remote-access Client row |
 | [`src/remote.ts`](src/remote.ts) | `TestRemote` double for host RPC, `RemoteError` value re-export |
 | [`src/translate.ts`](src/translate.ts) + [`src/locale-env.ts`](src/locale-env.ts) | Translation and pinned-browser-language test helpers |
 | [`src/config-form.ts`](src/config-form.ts) | `stubConfigForm` with test-driven publications and write spies |

package/README.zh.md

@@ -44,6 +44,8 @@ await runtime.dispose()
 
 `mount` 会预检必需服务，缺失时自明报错——先用 `provide(name, value)` 提供额外服务。运行时提供的 `fileUpload` 替身会拒绝每次调用，直到测试套件替换 `runtime.fileUpload.upload`。`storeOf(key, scopeKey)` 返回渲染器交给 slot 组件的实时存储实例，用于身份与动作驱动写入断言。
 
+运行时在 ui-session 之前安装 `allowAllAccessPlugin`：它的 `remoteAccess` 服务对每个资源都回答 true，因此每个访问 Hook 都允许每个 action。手工构造的组件 props 展开 `...allowAllAccess` 以获得同样的 Hook；测试被拒绝路径的 spec 覆盖其中一个 Hook。
+
 可选渲染参数通过 `entryKey` 选择 keyed 条目，或通过 `only` 选择 list 条目；`view.update(owner)` 保留该选择。`runtime.panelInfo` 提供默认的 `usePanelInfo` 数据源，初始不选中全局面板。挂载生产 Layout 所有者之前，先调用 `releasePanelInfoSource()` 释放该数据源。`dispose()` 同时释放默认的工作区与面板信息根数据源；提前释放是幂等的，不会移除替代它们的所有者。
 
 Session fixture 从显式提供的地址或已加载的父级投影解析子代理地址，不会保留 Session generation。外部目录项没有本地浏览地址。
@@ -91,7 +93,7 @@ test('registers into the sidebar', async ({ remote, start }) => {
 
 ### Roster 与启动行为
 
-`webApp` 是 `web` profile 的浏览器 roster，首次 import 装配入口时从它的 bundle（先 `dsh-base`、再 `dsh-web-app`）按启动器的方式现读，只是匹配不到任何行的补丁在这里抛错、启动器只警告：每个 bundle 的 `dsh.bundle.patch` 列表用 include 插件的 YAML 方言解析、用它的 `applyEntryPatches` 合成，每个未禁用且其包声明 `dsh.client.platform === 'web'` 的行成为一行，带上该声明的 `inject` 与 `immediately`；`bundleRoster(bundles, anchor, disabledContext)` 接受显式 Loader 求值作用域来处理条件 `disabled` 标记；未提供作用域时拒绝浏览器表达式。`webApp` 仅提供 Web profile 名称，不提供业务 Host 服务。没有任何东西从 bundle 拷贝出来，bundle 一改下次跑测试就能看见。`webApp.closure(names)` 保留点名的行及其传递注入的全部行（即按 bundle 组合方式起这些插件所需的行），`webApp.pick(names)` 与 `webApp.without(names)` 手工裁剪，三者都对未知名字抛错，`ClientRoster.of(rows)` 内联构造一份。`remoteDefaultResponses` 是 roster 在没有 session、没有 workspace、默认设置下启动时恰好会打的那些 Remote 端点的默认响应；测试用 `mock.load(table)` 在其上叠加自己的 `RemoteTable`，任何没有规则的调用都会在 `dispose()` 时经 `mock.assertNoUnmatched()` 让测试失败。`mount` 要求 roster 提供 `uiRenderer`；否则 `start` 响亮失败而不是返回一个空容器。`client.connection` 是 roster 的 Connection 服务（没有任何 `Context` 增强声明它），`connectTimeoutMs` 限定等就绪的时长，超时消息列出 mock log。`reload(name)` 通过共享的 Client Modules 辅助函数重建一个 Loader entry（先拆 registry，再 `entry.refresh()`）；每个客户端都保留自己的模块系统和绑定实例的 Connection 替换，因此启动与重载可以重叠而无需改写页面全局变量。`unload(name)` 移除 entry 并等待插件清理完成，`flush()` 在 `act` 内让 React 落定。jsdom 既没有 `EventSource`（client-hmr 在 apply 时打开一个）也没有 `ResizeObserver` 和 `document.fonts` 事件目标（布局组件挂载时观察尺寸与字体加载），所以 `start` 对缺失的全局惰性桩做引用计数，`dispose` 只移除它装的那些——这是 jsdom 的缺口，不是客户端身份通道。每个 roster 里的 `@deepseek-ai/dsh-api-remotes` 行都会被去掉：它生成的 Remote 客户端只存在于构建后的 `lib/`，而 `remote.<ns>` 正是本档要替掉的东西。`start` 改为给 roster 注入的每个 `remote.<ns>` 服务（加上此刻 mock 登记过规则的命名空间；之后才首次登记的命名空间没有代理）提供一个无契约代理；`ctx.remote.<ns>.<method>(...args)` 变成对端点 `<ns>/<method>` 的调用，携带位置参数，mock 登记了 `stream()` 脚本的走流、否则走一元，并沿用生成客户端的结果折叠（载体抛错折成 `gateway/internal`，中止折成 `gateway/cancelled`）。没有规则的端点照样发出，所以 mock 会记下它、`dispose()` 让测试失败。
+`webApp` 是 `web` profile 的浏览器 roster，首次 import 装配入口时从它的 bundle（先 `dsh-base`、再 `dsh-web-app`）按启动器的方式现读，只是匹配不到任何行的补丁在这里抛错、启动器只警告：每个 bundle 的 `dsh.bundle.patch` 列表用 include 插件的 YAML 方言解析、用它的 `applyEntryPatches` 合成，每个未禁用且其包声明 `dsh.client.platform === 'web'` 的行成为一行，带上该声明的 `inject` 与 `immediately`；`bundleRoster(bundles, anchor, disabledContext)` 接受显式 Loader 求值作用域来处理条件 `disabled` 标记；未提供作用域时拒绝浏览器表达式。`webApp` 仅提供 Web profile 名称，不提供业务 Host 服务。没有任何东西从 bundle 拷贝出来，bundle 一改下次跑测试就能看见。`webApp.closure(names)` 保留点名的行及其传递注入的全部行（即按 bundle 组合方式起这些插件所需的行），`webApp.pick(names)` 与 `webApp.without(names)` 手工裁剪，三者都对未知名字抛错，`ClientRoster.of(rows)` 内联构造一份。`remoteDefaultResponses` 是 roster 在没有 session、没有 workspace、默认设置下启动时恰好会打的那些 Remote 端点的默认响应；测试用 `mock.load(table)` 在其上叠加自己的 `RemoteTable`，任何没有规则的调用都会在 `dispose()` 时经 `mock.assertNoUnmatched()` 让测试失败。`mount` 要求 roster 提供 `uiRenderer`；否则 `start` 响亮失败而不是返回一个空容器。`client.connection` 是 roster 的 Connection 服务（没有任何 `Context` 增强声明它），`connectTimeoutMs` 限定等就绪的时长，超时消息列出 mock log。`reload(name)` 通过共享的 Client Modules 辅助函数重建一个 Loader entry（先拆 registry，再 `entry.refresh()`）；每个客户端都保留自己的模块系统和绑定实例的 Connection 替换，因此启动与重载可以重叠而无需改写页面全局变量。`unload(name)` 移除 entry 并等待插件清理完成，`flush()` 在 `act` 内让 React 落定。jsdom 既没有 `EventSource`（client-hmr 在 apply 时打开一个）也没有 `ResizeObserver` 和 `document.fonts` 事件目标（布局组件挂载时观察尺寸与字体加载），所以 `start` 对缺失的全局惰性桩做引用计数，`dispose` 只移除它装的那些——这是 jsdom 的缺口，不是客户端身份通道。每个 roster 里的 `@deepseek-ai/dsh-api-remotes` 行都会被去掉：它生成的 Remote 客户端只存在于构建后的 `lib/`，而 `remote.<ns>` 正是本档要替掉的东西。自行挂载其生成 contribution 的 `@deepseek-ai/dsh-api-remote-access` 行同样会被去掉，`start` 改为安装 `allowAllAccessPlugin`；计划中为这两行之一提供的 `provide` 项会被拒绝。`start` 改为给 roster 注入的每个 `remote.<ns>` 服务（加上此刻 mock 登记过规则的命名空间；之后才首次登记的命名空间没有代理）提供一个无契约代理；`ctx.remote.<ns>.<method>(...args)` 变成对端点 `<ns>/<method>` 的调用，携带位置参数，mock 登记了 `stream()` 脚本的走流、否则走一元，并沿用生成客户端的结果折叠（载体抛错折成 `gateway/internal`，中止折成 `gateway/cancelled`）。没有规则的端点照样发出，所以 mock 会记下它、`dispose()` 让测试失败。
 
 ### 何时使用
 
@@ -125,6 +127,7 @@ test('registers into the sidebar', async ({ remote, start }) => {
 | [`src/sessions.ts`](src/sessions.ts) + [`src/workspaces.ts`](src/workspaces.ts) | `ISessions`/`IWorkspaces` 测试替身与 `FixtureSession` 行为桩 |
 | [`src/fixtures.ts`](src/fixtures.ts) | 普通 fixture 构造器：会话快照、workspace 列表状态 |
 | [`src/snapshot.ts`](src/snapshot.ts) | DOM 快照序列化器（类名哈希折叠、`<svg>` 指纹） |
+| [`src/access.ts`](src/access.ts) | `allowAllAccess` props 与 `allowAllAccessPlugin`：remote-access Client 行的全允许替身 |
 | [`src/remote.ts`](src/remote.ts) | 用于 host RPC 的 `TestRemote` 替身、`RemoteError` 值转出 |
 | [`src/translate.ts`](src/translate.ts) + [`src/locale-env.ts`](src/locale-env.ts) | 翻译与固定浏览器语言测试辅助 |
 | [`src/config-form.ts`](src/config-form.ts) | 带测试驱动发布与写入 spy 的 `stubConfigForm` |

package/lib/index.js

@@ -1175,11 +1175,53 @@ var TestWorkspaces = class {
 	}
 };
 //#endregion
+//#region lib/types/access.js
+/**
+* Allow-all access for client specs. Production pages receive the
+* `remoteAccess` Client service and the global-resource `useRemoteAccess` Hook
+* from the remote-access Client plugin, and the Session and Workspace access
+* Hooks (Session-scope `useAccess`, `useSessionAccess`, `useWorkspaceAccess`)
+* from ui-session and ui-workspace over that service. The test runtimes
+* install an allow-all service and `useRemoteAccess` Hook instead, and
+* hand-built component props spread {@link allowAllAccess}; a spec of a
+* refused path overrides one Hook.
+* @module @deepseek-ai/dsh-client-test-runtime/src/access
+*/
+/** Access Hooks that allow every action on every resource, for hand-built component props. */
+const allowAllAccess = {
+	useRemoteAccess: () => true,
+	useAccess: () => true,
+	useSessionAccess: () => true,
+	useWorkspaceAccess: () => true
+};
+const ALLOWED = {
+	getSnapshot: () => true,
+	subscribe: () => () => {}
+};
+const allowed = () => ALLOWED;
+/** The `remoteAccess` Client service answering true for every resource. */
+const allowAllRemoteAccess = { source: allowed };
+/**
+* Plugin standing in for the remote-access Client row: it provides an
+* allow-all `remoteAccess` service, so ui-session and ui-workspace publish
+* their resource Hooks over it, and the allow-all `useRemoteAccess` Hook on
+* the global resource.
+*/
+const allowAllAccessPlugin = {
+	name: "client-test-runtime:allow-all-access",
+	inject: ["slots"],
+	/** @param ctx - plugin Context with the Slot registry injected. */
+	apply(ctx) {
+		ctx.provide("remoteAccess", allowAllRemoteAccess);
+		ctx.slots.provideRoot({ keyedHooks: { remoteAccess: allowed } });
+	}
+};
+//#endregion
 //#region lib/types/config-form.js
 /** Test doubles for settings transport. */
 /**
-* Build an in-memory settings scope for service specs: starts in the host
-* loading state, records writes, and lets the test publish Host acceptances.
+* Build an in-memory settings scope for service specs: starts in the loading
+* state, records writes, and lets the test publish Host acceptances.
 * @returns the stub handle.
 */
 function stubConfigForm() {
@@ -1189,8 +1231,7 @@ function stubConfigForm() {
 		base: void 0,
 		user: void 0,
 		revision: void 0,
-		writable: false,
-		mode: "host"
+		writable: false
 	};
 	const listeners = /* @__PURE__ */ new Set();
 	const set = vi.fn(() => Promise.resolve(true));
@@ -1462,6 +1503,7 @@ var SlotTestRuntime = class SlotTestRuntime {
 		const ctx = new Context();
 		await ctx.plugin(SlotRegistry).await();
 		const runtime = new SlotTestRuntime(ctx, ctx.get("slots"));
+		await ctx.plugin(allowAllAccessPlugin).await();
 		await ctx.plugin({
 			inject: [...inject],
 			apply
@@ -1632,4 +1674,4 @@ var SlotTestRuntime = class SlotTestRuntime {
 	}
 };
 //#endregion
-export { FixtureSession, RemoteError, SlotTestRuntime, TestRemote, TestRoot, TestSessions, TestWorkspaces, bindSnapshotSelector, chatSnapshot, conversationSnapshot, createSlotRenderer, domSnapshotSerializer, makeTranslate, registerDomSnapshotSerializer, sessionSnapshot, stubConfigForm, usePinnedBrowserLanguages, workspaceSnapshot };
+export { FixtureSession, RemoteError, SlotTestRuntime, TestRemote, TestRoot, TestSessions, TestWorkspaces, allowAllAccess, allowAllAccessPlugin, bindSnapshotSelector, chatSnapshot, conversationSnapshot, createSlotRenderer, domSnapshotSerializer, makeTranslate, registerDomSnapshotSerializer, sessionSnapshot, stubConfigForm, usePinnedBrowserLanguages, workspaceSnapshot };

package/lib/types/access.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Allow-all access for client specs. Production pages receive the
+ * `remoteAccess` Client service and the global-resource `useRemoteAccess` Hook
+ * from the remote-access Client plugin, and the Session and Workspace access
+ * Hooks (Session-scope `useAccess`, `useSessionAccess`, `useWorkspaceAccess`)
+ * from ui-session and ui-workspace over that service. The test runtimes
+ * install an allow-all service and `useRemoteAccess` Hook instead, and
+ * hand-built component props spread {@link allowAllAccess}; a spec of a
+ * refused path overrides one Hook.
+ * @module @deepseek-ai/dsh-client-test-runtime/src/access
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { GlobalStandardProps, SessionStandardProps } from '@deepseek-ai/dsh-client-ui-slots';
+/** The access Hooks every Slot component receives. */
+export type AccessStandardProps = Pick<GlobalStandardProps, 'useRemoteAccess' | 'useSessionAccess' | 'useWorkspaceAccess'> & Pick<SessionStandardProps, 'useAccess'>;
+/** Access Hooks that allow every action on every resource, for hand-built component props. */
+export declare const allowAllAccess: AccessStandardProps;
+/**
+ * Plugin standing in for the remote-access Client row: it provides an
+ * allow-all `remoteAccess` service, so ui-session and ui-workspace publish
+ * their resource Hooks over it, and the allow-all `useRemoteAccess` Hook on
+ * the global resource.
+ */
+export declare const allowAllAccessPlugin: {
+    name: string;
+    inject: string[];
+    /** @param ctx - plugin Context with the Slot registry injected. */
+    apply(ctx: Context): void;
+};
+//# sourceMappingURL=access.d.ts.map

package/lib/types/assembly/test-client.d.ts

@@ -38,8 +38,10 @@ export declare class TestClient {
      * dropped from the roster: its generated Remote clients exist only in built
      * `lib/`, and the `remote.<ns>` services the roster injects (plus the
      * namespaces the mock has rules for at this point) are provided as
-     * contract-free proxies over the same Connection instead; a `provide` entry
-     * for that row is refused. On any failure the context is disposed, an owned
+     * contract-free proxies over the same Connection instead. The
+     * `@deepseek-ai/dsh-api-remote-access` row, which mounts its own generated
+     * contribution, is dropped too, and allow-all access Hooks replace it. A
+     * `provide` entry for either row is refused. On any failure the context is disposed, an owned
      * mount removed, and this client's hold on the shims released before the
      * original error is rethrown.
      * @param plan - roster and annotations.

package/lib/types/config-form.d.ts

@@ -21,8 +21,8 @@ export interface StubConfigForm<T> {
     publish(next: Partial<ConfigFormSnapshot<T>>): void;
 }
 /**
- * Build an in-memory settings scope for service specs: starts in the host
- * loading state, records writes, and lets the test publish Host acceptances.
+ * Build an in-memory settings scope for service specs: starts in the loading
+ * state, records writes, and lets the test publish Host acceptances.
  * @returns the stub handle.
  */
 export declare function stubConfigForm<T>(): StubConfigForm<T>;

package/lib/types/index.d.ts

@@ -34,6 +34,8 @@ export { RemoteError, TestRemote } from './remote.ts';
 export { chatSnapshot, conversationSnapshot, sessionSnapshot, workspaceSnapshot, } from './fixtures.ts';
 export type { FixtureSnapshot, SessionBehaviorOverrides, SessionFixture, SessionFixtureSnapshot, Stabilizer, } from './fixtures.ts';
 export { makeTranslate } from './translate.ts';
+export { allowAllAccess, allowAllAccessPlugin } from './access.ts';
+export type { AccessStandardProps } from './access.ts';
 export { usePinnedBrowserLanguages } from './locale-env.ts';
 /**
  * Bind an observable source to the production renderer's selector hook.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-test-runtime",
   "description": "Browser test runtimes: a jsdom slot bench with test-owned Session and Workspace doubles, and a whole-client tier that boots the web roster through the production bootClient over an endpoint-named Remote mock",
-  "version": "0.2.1-alpha.2",
+  "version": "0.2.1-alpha.4",
   "publishConfig": {
     "access": "public"
   },
@@ -29,63 +29,63 @@
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.1",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-api-gateway": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-hmr": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-modules": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-chat": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-web": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.2",
+    "@deepseek-ai/dsh-api-gateway": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-hmr": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-modules": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-chat": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-web": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.4",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.1",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-api-gateway": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-base": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-hmr": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-modules": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-chat": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-web": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-web-app": "0.2.1-alpha.2",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/cordis-plugin-include": "~1.0.10-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.2",
+    "@deepseek-ai/dsh-api-gateway": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-remote-access": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-attachment": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-base": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-hmr": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-modules": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-chat": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-client-web": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-settings": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-web-app": "0.2.1-alpha.4",
     "@types/js-yaml": "^4.0.9",
-    "@types/react": "~18.3.1",
-    "@types/react-dom": "~18.3.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },