@deepseek-ai/dsh-settings-file 0.0.1-rc.3

package/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, DeepSeek
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/settings/settings-file/README.md
+README.md: 78ff50bd3f9b7c0bd52d50a837bc3cb7dad7c5be
+README.zh.md: 2be0494bd7fd40cb59ff3999f5405adc49ff2a2d

package/README.md

@@ -0,0 +1,45 @@
+# @deepseek-ai/dsh-settings-file
+
+English | [中文](README.zh.md)
+
+File-backed settings provider. One YAML or JSON document carries every namespace section; external edits hot-publish through `ctx.settings`, and `update()` re-reads the document under a writer lock before writing back atomically, preserving the user's YAML comments, any section owned by a plugin that is not currently loaded, and any on-disk change this process has not observed yet.
+
+## Config
+
+| Field | Meaning | Default |
+|---|---|---|
+| `path` | Settings document path; extension picks the format (`.yaml`/`.yml`/`.json`) | `settings.yaml` under the harness home |
+| `dshHome` | Harness home used when `path` is omitted | `$DSH_HOME` or `~/.dsh` |
+| `watch` | Watch the document and hot-publish external edits | `true` |
+| `debounceMs` | Watcher write-settle window in milliseconds | `100` |
+
+Defaulting is one explicit `resolveSpec(config)` step; an unsupported extension fails at load.
+
+## Behavior
+
+- **Boot fails loud, reload keeps last-good.** An existing-but-invalid document fails plugin load; once live, an unreadable or unparsable edit warns and keeps the last good sections. A missing document resolves every namespace from defaults and `base`; deleting it publishes the same empty state.
+- **Every write is a read-modify-write.** A persist first re-reads the document and publishes any difference into the seam — an external edit still inside the watcher debounce window, a change the watcher missed, or another process's write — then renders against that fresh text, so a write can never resurrect a stale document or drop an unobserved sibling section. If the on-disk document turned invalid, the write rejects loud instead of overwriting the user's manual edit.
+- **Writes hold a cross-process writer lock.** The read-render-rename cycle runs under a `wx`-created `<file>.lock` sibling with exponential backoff and a 2 s acquisition deadline. A contender times out without removing the existing lock because age cannot distinguish a crashed owner from a paused live writer; orphan recovery is an operator action. Readers never take the lock: the rename commit is atomic, so reloads are always consistent.
+- **Write-back is atomic, owner-only, and symlink-proof.** The render exclusive-creates a random-suffix temp sibling with mode `0600` (`wx` refuses to follow a planted symlink) and renames over the target, cleaning the temp up on failure.
+- **YAML edits are leaf-level diffs.** A write sets only the values that changed and deletes only the keys that were removed, so comments, anchors, and formatting survive on every untouched node and on the key of every changed pair; a changed array (or other non-map value) replaces wholesale, taking comments inside it along. JSON re-serializes without comments.
+- **Reloads and writes share one operation chain.** Watcher refreshes and persists from every namespace queue run one at a time in queue order; each render sees the text the previous operation committed.
+- **The watcher's ready signal reconciles once.** The initial load races the watcher's own setup, so a change written in between never fires an event; the reconcile at ready closes that startup gap.
+- **The native watcher receives a canonical path.** Before Chokidar opens the target, the provider realpaths its deepest existing ancestor and restores any missing suffix. File access and user-facing diagnostics retain the configured path, while Windows cannot mix an 8.3 alias with long-form event paths inside libuv.
+- **Dispose quiesces in every watch mode.** Teardown marks the provider closed, closes the watcher when present, then waits out every queued or in-flight document operation, so nothing publishes after disposal.
+- **Self-write suppression by content.** The provider caches the last good text; a watcher event whose content equals the cache (its own write included) is a no-op.
+- **Host configuration adapters receive the resolved path.** `ctx.settings.documentPath` is the absolute `resolveSpec()` filename, including a custom YAML/JSON path; `prepareDocument()` preserves an existing file or exclusively creates an absent empty file with owner-only permissions before the Host opens it. The browser receives only an availability flag, never reconstructs `$DSH_HOME`, and never submits a filesystem target.
+
+## Model Experience
+
+Indirectly, through consumers of `ctx.settings`: this provider only stores and publishes namespace sections, and each consumer's own surface documents any model effect.
+
+#### KV Cache effect
+
+No direct invalidation; the consuming plugin owns any request-prefix changes.
+
+## Known Limitations and Deferred Work
+
+- **Same-namespace conflicts stay last-write-wins** — the writer lock and read-modify-write keep concurrent writers from dropping each other's namespaces, but two writers editing one namespace still resolve to the later write; there is no per-value merge or revision check.
+- **A missed watcher event stays unseen until the next signal** — reads never re-stat the file, so a change the watcher fails to report is only folded in by the next event, the next write, or a restart.
+- **Comment preservation is YAML-only and map-shaped** — JSON documents re-serialize without comments (JSON has none), and comments inside a changed array (or attached inline to a changed scalar value) go with the value they described.
+- **No value indirection** — sections hold literal values; `${env:VAR}`-style references for secrets are a deferred seam-level feature.

package/README.zh.md

@@ -0,0 +1,45 @@
+# @deepseek-ai/dsh-settings-file
+
+[English](README.md) | 中文
+
+基于文件的设置提供方。一个 YAML 或 JSON 文档承载全部 namespace 分节；外部编辑经 `ctx.settings` 热发布，`update()` 在写锁下先重读文档再原子写回，保留用户的 YAML 注释、当前未加载插件所拥有的分节，以及任何本进程尚未观察到的磁盘变更。
+
+## 配置
+
+| 字段 | 含义 | 默认 |
+|---|---|---|
+| `path` | 设置文档路径；扩展名决定格式（`.yaml`/`.yml`/`.json`） | harness home 下的 `settings.yaml` |
+| `dshHome` | `path` 省略时使用的 harness home | `$DSH_HOME` 或 `~/.dsh` |
+| `watch` | 监听文档并热发布外部编辑 | `true` |
+| `debounceMs` | watcher 写入稳定窗口（毫秒） | `100` |
+
+默认值解析是一步显式的 `resolveSpec(config)`；不支持的扩展名在加载时报错。
+
+## 行为
+
+- **启动失败并明确报错，重载保留最后可用值。** 存在但非法的文档使插件加载失败；运行中不可读或不可解析的编辑只告警并保留最后可用分节。文档缺失时所有 namespace 按默认值与 `base` 解析；删除文档发布同样的空状态。
+- **每次写入都是一次读-改-写。** persist 先重读文档并把任何差异发布进 seam——无论是仍在 watcher 防抖窗口内的外部编辑、watcher 漏掉的变更，还是另一个进程的写入——再基于这份新鲜文本渲染，因此写入绝不会复活陈旧文档，也不会丢掉未观察到的同级分节。若磁盘上的文档已变为非法，写入会明确报错并拒绝执行，而不是覆盖用户的手工编辑。
+- **写入持有跨进程写锁。** 读-渲染-rename 流程在以 `wx` 创建的同级锁文件 `<file>.lock` 保护下运行，带指数退避与 2 s 的获取期限。竞争者会超时，但不会移除现有锁，因为锁龄无法区分已经崩溃的所有者与被暂停但仍存活的写入方；遗留锁恢复须由操作者执行。读取方从不取锁：rename 提交是原子的，重载因此始终一致。
+- **写回原子、仅属主可访问、抗符号链接。** 渲染以 `0600` 权限独占创建随机后缀临时同级文件（`wx` 拒绝跟随预埋符号链接）后 rename 覆盖目标，失败时清理临时文件。
+- **YAML 编辑是叶子级 diff。** 写入只设置发生变化的值、只删除被移除的键，因此注释、锚点与排版在每个未触碰的节点上以及每个被改键值对的键上都得以保留；被改的数组（或其他非 map 值）整体替换，其中的注释随之一同被换掉。JSON 重新序列化，无注释。
+- **重载与写入共享一条操作链。** watcher 刷新与来自各 namespace 队列的 persist 按队列顺序逐个执行；每次渲染都基于上一次操作提交后的文本。
+- **watcher 的 ready 信号做一次对账。** 初始加载与 watcher 自身的建立存在竞态，因此其间写入的变更绝不会触发事件；ready 时的对账补上这个启动缺口。
+- **原生 watcher 接收规范化路径。** 在 Chokidar 打开目标之前，提供方会对层级最深的现有祖先路径执行 realpath 解析，再拼回缺失的后缀。文件访问和面向用户的诊断仍使用配置路径，从而避免 Windows 在 libuv 内部混用 8.3 别名与长格式事件路径。
+- **dispose（资源释放）在每种 watch 模式下都保证完全停稳。** 卸载先把提供方标记为已关闭，在 watcher 存在时将其关闭，再等待所有已排队或进行中的文档操作完成，之后不再有任何发布。
+- **按内容抑制自写。** 提供方缓存最后可用文本；watcher 事件内容与缓存相同（含自己的写入）即为 no-op。
+- **Host 配置适配器会收到解析后的路径。** `ctx.settings.documentPath` 是 `resolveSpec()` 得出的绝对文件名，包括自定义 YAML/JSON 路径；`prepareDocument()` 会保留现有文件，或在 Host 打开文档前，以仅属主可访问的权限独占创建缺失的空文件。浏览器只收到可用性标志，绝不重建 `$DSH_HOME`，也绝不提交文件系统目标。
+
+## 模型体验
+
+间接生效：本提供方只存储并发布 namespace 分节，任何模型效果都经由 `ctx.settings` 的消费方产生，并由各消费方自己的接口文档说明。
+
+#### KV Cache 影响
+
+无直接失效；请求前缀的任何变更均由消费方插件负责。
+
+## 已知限制与暂缓事项
+
+- **同 namespace 冲突仍是后写胜出** — 写锁加读-改-写让并发写入者不会丢掉彼此的 namespace，但两个写入者编辑同一个 namespace 时仍以较后的写入为准；没有按值合并，也没有修订检查。
+- **漏掉的 watcher 事件在下一个信号前保持不可见** — 读取从不重新 stat 文件，因此 watcher 漏报的变更只会在下一个事件、下一次写入或重启时被并入。
+- **注释保留仅限 YAML 且仅限 map 形状** — JSON 文档重新序列化，无注释（JSON 本身没有），且被改数组内部的注释（或行内附着在被改标量值上的注释）随其所描述的值一同被换掉。
+- **无值间接引用** — 分节存字面值；面向密钥的 `${env:VAR}` 式引用是暂缓实现的 seam 层功能。

package/lib/index.js

@@ -0,0 +1,284 @@
+import { Service } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+import { watch } from "chokidar";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, extname, join, resolve } from "node:path";
+import { Document, parseDocument } from "yaml";
+import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { canonicalizeWatchPath, resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { SettingsProvider, deepEqualJson } from "@deepseek-ai/dsh-settings";
+//#region lib/types/index.js
+/**
+* File-backed settings provider. One YAML or JSON document under the user's
+* harness home carries every namespace section; external edits hot-publish
+* through the seam, and every write re-reads the document under a
+* cross-process writer lock before patching it as a comment-preserving
+* leaf-level diff.
+* @module @deepseek-ai/dsh-settings-file
+*/
+const FORMATS = {
+	".yaml": "yaml",
+	".yml": "yaml",
+	".json": "json"
+};
+/**
+* Resolve the runtime spec from plugin config: an explicit `path` wins,
+* otherwise the document lives at `<harness home>/settings.yaml`.
+* @param config - raw plugin config.
+* @returns the resolved file location, format, and watch behavior.
+*/
+function resolveSpec(config) {
+	const filename = resolve(config.path ?? join(resolveDshHome(config.dshHome), "settings.yaml"));
+	const format = FORMATS[extname(filename)];
+	if (format === void 0) throw new Error(`settings-file: extension "${extname(filename)}" is not supported (use .yaml, .yml, or .json)`);
+	return {
+		filename,
+		format,
+		watch: config.watch ?? true,
+		debounceMs: config.debounceMs ?? 100
+	};
+}
+/** Whether a parsed YAML value is a map for diffing purposes. */
+function isMapLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Apply the difference between one node's stored and next value as minimal
+* `setIn`/`deleteIn` edits, recursing through maps, so every untouched node —
+* and the key node of every changed pair — keeps its comments, anchors, and
+* formatting. Non-map values (arrays and scalars) replace wholesale when
+* unequal, taking any comments inside them along.
+*/
+function patchNode(document, path, current, next) {
+	if (isMapLike(current) && isMapLike(next)) {
+		for (const key of Object.keys(current)) if (!(key in next)) document.deleteIn([...path, key]);
+		for (const [key, value] of Object.entries(next)) patchNode(document, [...path, key], current[key], value);
+		return;
+	}
+	if (!deepEqualJson(current, next)) document.setIn([...path], next);
+}
+/** Whether a filesystem error means absence; every non-ENOENT failure must surface. */
+function isENOENT(error) {
+	return error?.code === "ENOENT";
+}
+/** Whether an exclusive file create found an existing document. */
+function isEEXIST(error) {
+	return error?.code === "EEXIST";
+}
+/** File-backed settings provider (`settings.yaml`/`.json`). */
+var FileSettingsProvider = class extends SettingsProvider {
+	config;
+	static Config = z.object({
+		path: z.string(),
+		dshHome: z.string(),
+		watch: z.boolean().default(true),
+		debounceMs: z.number().min(0).default(100)
+	});
+	spec;
+	/**
+	* Raw text of the last successfully parsed or persisted document;
+	* `undefined` while the file is absent. Watcher events whose content equals
+	* this cache are no-ops, which is also the self-write suppression.
+	*/
+	text;
+	/**
+	* Single exclusive operation chain: watcher reloads and document writes run
+	* one at a time in queue order (settled tail), so a write can never render
+	* from text a concurrent reload is busy replacing, and a reload can never
+	* read a half-committed write.
+	*/
+	operations = Promise.resolve();
+	/** Set at dispose: refuse new watcher events and let in-flight work no-op. */
+	closed = false;
+	/** Opaque read of {@link closed}: control flow cannot narrow it across awaits. */
+	isClosed() {
+		return this.closed;
+	}
+	constructor(ctx, config) {
+		super(ctx);
+		this.config = config;
+		this.spec = resolveSpec(config);
+	}
+	/** The local document is always writable through {@link SettingsProvider.update}. */
+	get writable() {
+		return true;
+	}
+	/** The resolved YAML/JSON document path exposed to local configuration surfaces. */
+	get documentPath() {
+		return this.spec.filename;
+	}
+	/** Materialize an absent owner-only document, then return its resolved path. */
+	prepareDocument() {
+		return this.enqueue(async () => {
+			await mkdir(dirname(this.spec.filename), {
+				recursive: true,
+				mode: 448
+			});
+			await withFileLock(this.spec.filename, async () => {
+				try {
+					await writeFile(this.spec.filename, "", {
+						flag: "wx",
+						mode: 384
+					});
+				} catch (error) {
+					if (isEEXIST(error)) return;
+					throw error;
+				}
+				this.text = "";
+				if (!this.isClosed()) this.publish({});
+			});
+			return this.spec.filename;
+		});
+	}
+	async load() {
+		let text;
+		try {
+			text = await readFile(this.spec.filename, "utf8");
+		} catch (error) {
+			if (!isENOENT(error)) throw error;
+			this.text = void 0;
+			return {};
+		}
+		const doc = this.parse(text);
+		this.text = text;
+		return doc;
+	}
+	persist(ns, section) {
+		return this.enqueue(() => this.persistSection(ns, section));
+	}
+	/** Queue one exclusive document operation behind every earlier one. */
+	enqueue(operation) {
+		const task = this.operations.then(operation);
+		this.operations = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	/** Queue a reload; only an invariant violation escaping a commit can reject it. */
+	queueRefresh() {
+		this.enqueue(() => this.refresh()).catch((error) => {
+			this.ctx.logger.error("settings-file: reload commit failed at %s", this.spec.filename);
+			this.ctx.logger.error(error);
+		});
+	}
+	async persistSection(ns, section) {
+		await mkdir(dirname(this.spec.filename), {
+			recursive: true,
+			mode: 448
+		});
+		await withFileLock(this.spec.filename, async () => {
+			await this.reconcileFromDisk();
+			const output = this.spec.format === "yaml" ? this.renderYaml(ns, section) : this.renderJson(ns, section);
+			await writeFileAtomic(this.spec.filename, output, {
+				mode: 384,
+				dirMode: 448
+			});
+			this.text = output;
+		});
+	}
+	async *[Service.init]() {
+		yield* super[Service.init]();
+		const watcher = this.spec.watch ? watch(await canonicalizeWatchPath(this.spec.filename), {
+			ignoreInitial: true,
+			awaitWriteFinish: {
+				stabilityThreshold: this.spec.debounceMs,
+				pollInterval: Math.max(1, Math.min(this.spec.debounceMs, 10))
+			}
+		}) : void 0;
+		if (watcher !== void 0) {
+			watcher.on("all", () => {
+				if (this.closed) return;
+				this.queueRefresh();
+			});
+			watcher.on("ready", () => {
+				if (this.closed) return;
+				this.queueRefresh();
+			});
+			watcher.on("error", (error) => {
+				this.ctx.logger.warn("settings-file: watcher error on %s", this.spec.filename);
+				this.ctx.logger.warn(error);
+			});
+		}
+		yield async () => {
+			this.closed = true;
+			await watcher?.close();
+			await this.operations;
+		};
+	}
+	/** Parse one document text into raw sections, failing on a non-map root. */
+	parse(text) {
+		let root;
+		if (this.spec.format === "yaml") {
+			const document = parseDocument(text, { prettyErrors: true });
+			if (document.errors.length > 0) throw new Error(`settings-file: invalid document at ${this.spec.filename}: ${document.errors.map((error) => {
+				const at = error.linePos?.[0];
+				/* v8 ignore next -- `prettyErrors` populates linePos on every error; the guard answers its optional type */
+				return `${error.code}${at === void 0 ? "" : ` at line ${String(at.line)}, column ${String(at.col)}`}`;
+			}).join("; ")}`);
+			root = document.toJS() ?? {};
+		} else root = text.trim().length === 0 ? {} : JSON.parse(text);
+		if (typeof root !== "object" || root === null || Array.isArray(root)) throw new TypeError(`settings-file: ${this.spec.filename} must be a map of namespace sections`);
+		return root;
+	}
+	/**
+	* Re-read the document after a watcher event. Unchanged content (including
+	* this provider's own writes) is a no-op; an unreadable or unparsable
+	* document keeps the last good sections and warns — a live hot-reload must
+	* never take the process down. An invariant violation escaping a commit is
+	* not a reload failure and propagates to the queue's error surface.
+	*/
+	async refresh() {
+		if (this.closed) return;
+		try {
+			await this.reconcileFromDisk();
+		} catch (error) {
+			if (error?.code === "INVARIANT") throw error;
+			this.ctx.logger.warn("settings-file: reload failed at %s; keeping the last good document", this.spec.filename);
+			this.ctx.logger.warn(error);
+		}
+	}
+	/**
+	* Compare the on-disk text against the cache and publish any difference
+	* into the seam. Absence publishes the empty document; an unreadable or
+	* unparsable file throws, so each caller picks its policy — a reload warns
+	* and keeps the last good document, a write fails loud.
+	*/
+	async reconcileFromDisk() {
+		let text;
+		try {
+			text = await readFile(this.spec.filename, "utf8");
+		} catch (error) {
+			if (!isENOENT(error)) throw error;
+			text = void 0;
+		}
+		if (text === this.text || this.isClosed()) return;
+		if (text === void 0) {
+			this.text = void 0;
+			this.publish({});
+			return;
+		}
+		const doc = this.parse(text);
+		this.text = text;
+		this.publish(doc);
+	}
+	/**
+	* Render the next YAML text by patching one namespace in the
+	* comment-preserving document. The next section lands as a leaf-level diff
+	* against the stored one — only changed values set, only removed keys
+	* delete — so comments inside the section survive edits to their siblings,
+	* not just comments outside it.
+	*/
+	renderYaml(ns, section) {
+		if (this.text === void 0) return new Document({ [ns]: section }).toString();
+		const document = parseDocument(this.text);
+		const root = document.toJS();
+		patchNode(document, [ns], isMapLike(root) ? root[ns] : void 0, section);
+		return document.toString();
+	}
+	/** Render the next JSON text by replacing one namespace key. */
+	renderJson(ns, section) {
+		const root = this.text === void 0 ? {} : this.parse(this.text);
+		root[ns] = section;
+		return `${JSON.stringify(root, null, 2)}\n`;
+	}
+};
+//#endregion
+export { FileSettingsProvider, FileSettingsProvider as default, resolveSpec };

package/lib/invariant.js

@@ -0,0 +1,24 @@
+//#region lib/types/invariant.js
+/**
+* Package-owned invariant companion for `@deepseek-ai/dsh-settings-file`.
+* @module @deepseek-ai/dsh-settings-file/invariant
+*/
+const PACKAGE_NAME = "@deepseek-ai/dsh-settings-file";
+/** Cordis companion plugin name. */
+const name = "settings-file-invariant";
+/** Service required before the companion can reserve package ownership. */
+const inject = ["invariants"];
+/**
+* No runtime invariant: this provider's contracts are file round-trip,
+* watcher timing, and atomic-write behavior — IO effects proven by package
+* tests; the in-process commit relation is owned by `@deepseek-ai/dsh-settings`.
+*/
+const install = () => {};
+/**
+* Register this package's invariant companion.
+* @param ctx - Cordis context carrying the invariant service.
+* @returns the installed registration's disposer after setup succeeds.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/index.d.ts

@@ -0,0 +1,105 @@
+/**
+ * File-backed settings provider. One YAML or JSON document under the user's
+ * harness home carries every namespace section; external edits hot-publish
+ * through the seam, and every write re-reads the document under a
+ * cross-process writer lock before patching it as a comment-preserving
+ * leaf-level diff.
+ * @module @deepseek-ai/dsh-settings-file
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { SettingsProvider, type SettingsNamespace } from '@deepseek-ai/dsh-settings';
+/** Plugin config: file location and hot-reload behavior. */
+export interface Config {
+    /** Settings document path; defaults to `settings.yaml` under the harness home. */
+    path?: string;
+    /** Harness home used when `path` is omitted; defaults to `$DSH_HOME` or `~/.dsh`. */
+    dshHome?: string;
+    /** Watch the document and hot-publish external edits; defaults to true. */
+    watch?: boolean;
+    /** Watcher write-settle window in milliseconds; defaults to 100. */
+    debounceMs?: number;
+}
+/** Document format derived from the configured file extension. */
+type SettingsFormat = 'yaml' | 'json';
+/** Fully resolved provider parameters; defaulting happens here, never inline. */
+interface ResolvedSpec {
+    filename: string;
+    format: SettingsFormat;
+    watch: boolean;
+    debounceMs: number;
+}
+/**
+ * Resolve the runtime spec from plugin config: an explicit `path` wins,
+ * otherwise the document lives at `<harness home>/settings.yaml`.
+ * @param config - raw plugin config.
+ * @returns the resolved file location, format, and watch behavior.
+ */
+export declare function resolveSpec(config: Config): ResolvedSpec;
+/** File-backed settings provider (`settings.yaml`/`.json`). */
+export declare class FileSettingsProvider extends SettingsProvider {
+    config: Config;
+    static Config: z<Config>;
+    private readonly spec;
+    /**
+     * Raw text of the last successfully parsed or persisted document;
+     * `undefined` while the file is absent. Watcher events whose content equals
+     * this cache are no-ops, which is also the self-write suppression.
+     */
+    private text;
+    /**
+     * Single exclusive operation chain: watcher reloads and document writes run
+     * one at a time in queue order (settled tail), so a write can never render
+     * from text a concurrent reload is busy replacing, and a reload can never
+     * read a half-committed write.
+     */
+    private operations;
+    /** Set at dispose: refuse new watcher events and let in-flight work no-op. */
+    private closed;
+    /** Opaque read of {@link closed}: control flow cannot narrow it across awaits. */
+    private isClosed;
+    constructor(ctx: Context, config: Config);
+    /** The local document is always writable through {@link SettingsProvider.update}. */
+    get writable(): boolean;
+    /** The resolved YAML/JSON document path exposed to local configuration surfaces. */
+    get documentPath(): string;
+    /** Materialize an absent owner-only document, then return its resolved path. */
+    prepareDocument(): Promise<string>;
+    protected load(): Promise<Record<string, unknown>>;
+    protected persist(ns: SettingsNamespace, section: Record<string, unknown>): Promise<void>;
+    /** Queue one exclusive document operation behind every earlier one. */
+    private enqueue;
+    /** Queue a reload; only an invariant violation escaping a commit can reject it. */
+    private queueRefresh;
+    private persistSection;
+    [Service.init](): AsyncGenerator<() => Promise<void> | void, void, void>;
+    /** Parse one document text into raw sections, failing on a non-map root. */
+    private parse;
+    /**
+     * Re-read the document after a watcher event. Unchanged content (including
+     * this provider's own writes) is a no-op; an unreadable or unparsable
+     * document keeps the last good sections and warns — a live hot-reload must
+     * never take the process down. An invariant violation escaping a commit is
+     * not a reload failure and propagates to the queue's error surface.
+     */
+    private refresh;
+    /**
+     * Compare the on-disk text against the cache and publish any difference
+     * into the seam. Absence publishes the empty document; an unreadable or
+     * unparsable file throws, so each caller picks its policy — a reload warns
+     * and keeps the last good document, a write fails loud.
+     */
+    private reconcileFromDisk;
+    /**
+     * Render the next YAML text by patching one namespace in the
+     * comment-preserving document. The next section lands as a leaf-level diff
+     * against the stored one — only changed values set, only removed keys
+     * delete — so comments inside the section survive edits to their siblings,
+     * not just comments outside it.
+     */
+    private renderYaml;
+    /** Render the next JSON text by replacing one namespace key. */
+    private renderJson;
+}
+export default FileSettingsProvider;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-settings-file`.
+ * @module @deepseek-ai/dsh-settings-file/invariant
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis companion plugin name. */
+export declare const name = "settings-file-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@deepseek-ai/dsh-settings-file",
+  "description": "File-backed settings provider (settings.yaml) for the DeepSeek Harness",
+  "version": "0.0.1-rc.3",
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/settings/settings-file"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "BSD-3-Clause",
+  "peerDependencies": {
+    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-home-paths": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-settings": "^0.0.1-rc.3",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+  },
+  "dependencies": {
+    "chokidar": "^4.0.3",
+    "yaml": "^2.9.0",
+    "@deepseek-ai/schemastery": "^3.18.1-rc.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-atomic-write": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-invariants": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-home-paths": "^0.0.1-rc.3",
+    "@deepseek-ai/dsh-settings": "^0.0.1-rc.3",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1"
+  }
+}