@deepseek-harness-tui/dsh-tui 0.10.0 → 0.10.1

package/README.md

@@ -150,8 +150,152 @@ sh install.sh
 | 实验性（仍可能随 dsh-std / 准入规范演进调整） | 九 决策事件 · toast 通知（`ctx.tuiToast`，新增） |
 | 跟随上游（稳定性由 cordis / dsh 官方机制决定） | 一 会话事件 · 二 官方 prompt 槽位 · 三 技能打包 · 四 主题 · 五 system prompt 段 · 七 profile 组合 |
 
-另：`@deepseek-harness-tui/dsh-tui/test-utils`（headless 准入/挂载测试助手）与
-`@deepseek-harness-tui/dsh-tui/api`（纯类型入口）为实验性公开面。
+另：`@deepseek-harness-tui/dsh-tui/api`（纯类型入口）为实验性公开面。
+`@deepseek-harness-tui/dsh-tui/test-utils` 公共子路径已移除——它包含可注入真实
+activationId 的测试助手，不适合作为公共生产 API；需要 headless 测试请复制仓库内
+`scripts/lib/plugin-test-utils.ts` 的思路，在自己的测试环境走正式准入流程。
+
+公共面的导入迁移：
+- **`ctx.tuiPluginHost.grants.corrupt` 已不存在**。新的 `HostGrantFacade` 只暴露
+  `allows(pluginCtx, permission, scope)`、`defaultOf`、`knownPermissions` 和
+  `onChange(pluginCtx, listener)`；损坏的 grant 文件不再通过一个布尔字段暴露给插件。
+  `onChange` 是 subscribe 类托管能力：必须传入调用 activation，受 shadow 门禁约束，
+  返回的取消函数绑定到该 activation，避免文件轮询/监听器泄漏。需要诊断时请使用
+  `ctx.tuiPluginHost.selfCheck()`、`/doctor`，或通过显式诊断查询在宿主侧检查
+  grant 文件状态。
+- `createAdmissionCatalog` 不再从 `./plugin-host` 导出；诊断请使用
+  `ctx.tuiPluginHost.selfCheck()` 与 `/doctor`。
+- `ctx.tuiPluginHost.grants` 改为调用方安全的 `HostGrantFacade`：
+  `grants.allows(pluginCtx, permission, scope)` 由宿主从当前 activation 推导身份，
+  不再接受任意 `GrantPrincipal`/完整 `GrantStore`。
+- `GrantStore`、`GrantPrincipal` 不再是公开导出的插件 API；它们保留在
+  `src/adapter/standard/grants.ts` 作为宿主内部实现类型。需要构造/校验 grant
+  文件的宿主方请走仓库内部路径，生态测试不要在公共包依赖这些类型。
+- `@deepseek-harness-tui/dsh-tui/test-utils` 子路径已删除；仓库内的
+  `scripts/lib/plugin-test-utils.ts` 仅用于本仓库无头验证，不属于公共契约。
+  生态插件请在自己的测试环境通过正式 admission 流程复现。
+
+### 平台已知边界（Shadow 门禁不承诺覆盖）
+
+TUI 的 shadow/门禁只覆盖自有托管接缝；以下由 Cordis/上游 DSH 拥有的路径属于已写死的
+平台边界，不会被门禁描述为全路径覆盖：
+
+- 直接 `ctx.get('commands').register` / `ctx.get('commands').execute`（C-070）；
+- `ctx.plugin()` / `candidate.plugin()` 子插件安装（Cordis 平台）；
+- agent preset 名册 / recompose 注册（`@deepseek-ai/dsh-agent-presets`）；
+- system prompt section 注册（`@deepseek-ai/dsh-system-prompt`）；
+- skill registry 注册/调用（`@deepseek-ai/dsh-skill`）。
+
+这些路径在 `verify-adapter-shadow` 中以 `platform-known boundary` 显式列出。
+此外，`verify-adapter-shadow` 还显式记录两类门禁已知边界：未列入
+`NON_SERVICE_POLICY` 的内部 TUI 状态/视图辅助类，以及 `src/screens`/
+`src/components` 的 React UI 状态与事件处理——它们不是 adapter capability
+入口，门禁不将其描述为已覆盖。
+
+
+### Adapter live-probe 诚实性与 P2 边界
+
+本轮把 `Command` / `LocalStorage` / `MessageObserver` 从“无实探的 staged”
+推进到了“有可逆实探的 live”（在 legacy/new 模式下异步执行），并实现最小
+`KernelRuntime` 与 passive/replay harness：
+
+- **Command live probe**：在真实命令服务上临时注册唯一 no-op command，经
+  `find` / `list` 验证可见，并以内存 fake agent session 执行一次，确认
+  execute 返回 success；无论成功失败都在 `finally` 反注册。该操作不写任何
+  DSH 持久化 session 日志，唯一瞬时副作用是进程内命令注册表的一次
+  `commands/change` 通知。
+- **LocalStorage live probe**：在真实 storage 目录下创建随机临时 namespace
+  文件，完成 write/read/delete，并在 `finally` 删除；不触碰任何真实插件
+  namespace，也不保留探针数据。
+- **MessageObserver live probe**：通过 broker 的内部 probe-only 发布通道添加一个临时探针订阅并投递一条合成事件；真实插件的 `session:*` 通配订阅不会收到任何探针消息，探针结束后订阅数回到原值。这些 live probe 方法不是插件可见的公开 service 方法，宿主内核通过内部 host-only accessor 调用。
+- **默认 legacy 兼容发布**：`DSH_TUI_ADAPTER_MODE` 默认是 `legacy`，不会加载新 Kernel、不会执行可逆 live probe。该模式保留旧发布语义，使用独立的 `buildLegacyHostDescriptor` 路径：只要 Command / LocalStorage / MessageObserver 的既有服务行已挂载，`describe()` / `hostDescriptor()` 就发布这些契约供插件准入使用；构建结果会在 warnings 中明确标注为 legacy 兼容声明，与新模式 live-only 的公开 descriptor 分离。
+- **模式配置 fail-closed**：只有未设置 `DSH_TUI_ADAPTER_MODE` 时才默认 `legacy`；显式值只接受 `legacy` / `passive-shadow` / `replay-shadow` / `new`（忽略大小写与首尾空白），空值或未知值会报错并拒绝启动。非 legacy 模式在 Kernel 未就绪、refresh skipped/failed 或已释放时返回空契约 descriptor，不回退兼容发布。
+- **Host probe 访问边界**：`host-probe-access` 内部的 token 是模块级不导出符号，普通包 exports 路径也拒绝 deep import。但插件与宿主同进程时，绝对路径加载内部文件仍无法被 `exports` 阻止——这是 **trusted-in-process 边界，不是安全沙箱**；宿主不会用“插件不可调用”这类无限定承诺。内部注册函数不会覆盖已引导的宿主 probe runner。
+- **Passive Shadow**：不执行上述可逆 probe，只做只读 detect/descriptor 快照；
+  **Replay Shadow**：生产环境不接真实 DSH，必须通过 `scripts/verify-adapter-replay-harness.ts`
+  或 `src/adapter/kernel/replay.ts` 在隔离 replay context 上运行，否则 fail-closed
+  并输出明确提示。
+- Replay harness 用法：在隔离输入上运行
+  `node --import tsx/esm scripts/verify-adapter-replay-harness.ts`（门禁脚本），
+  或在代码中调用 `runReplayShadow({ schemaVersion: 'tui-adapter-replay/v1', ... })`
+  获取 `{ kernelContracts, legacyContracts, missing, extra, lifecycles }` 对比报告。
+  P5 起还支持真实 DSH session snapshot/transcript 的
+  `runChannelReplay(...)` / `verify:adapter-channel-conformance`，走
+  `tui.dsh/v1alpha1#Channel` 的 Provider/Consumer 与协议校验。
+- 公开 Host Descriptor 仍然只发布带真实 probe evidence 的 live 生命周期；
+  未完成 live refresh 或 passive/replay 下 `Command` / `LocalStorage` /
+  `MessageObserver` 保持 staged/degraded，不伪造完整支持。`DecisionEvents`
+  维持逐 feature probe + 真实 channel/dispatch 拓扑发布规则。
+- P6 已彻底移除内部 `admissionCompat` 平行视图，并删除
+  `src/plugin-spec/*` 与 `src/dsh-adapter/{grants,host-descriptor}.ts` compat
+  shim。生产代码直接导入 `src/adapter/standard/*`；`verify:compat-removal`
+  现在扫描 `src/`、`scripts/`、`bin/`、生成 `lib/`（存在时）与 package export
+  图，`verify:package` 也会拒绝 npm tarball 中的旧 shim；仍保留的兼容别名
+  （`ExtensionGrants`、`envelopeSchema`、`createAdmissionCatalog`、
+  `facadeFromLegacy` 等）已明确标注为 P6 范围外/长期兼容面。
+- 新 Kernel 不再是 P1 空壳：`KernelRuntime` 管理 driver 注册/mount、detection、
+  `declared → staged → live`、清理与诊断快照；生产 Host Descriptor、`getHostFacade()`、
+  `/doctor`、`/plugins` 均走该 runtime。
+- **P3 feature-level live 拆分**：`Workspace` / `Scenes` / `Settings` /
+  `Extensions` 不再用“注册+list+dispose”冒充整个能力 live。只有实际通过
+  只读/可逆探针验证的方法才进入 live（如 `host.workspaces.list`、
+  `host.workspaces.resolve`、`host.scenes.register`、`host.settings.register`、
+  `host.status.set`、`host.command-trees.children` 等）；
+  `host.toast.show` 因尚未验证真实生产 deliver 路径，保持 degraded；
+  `rename` / `runCommand` / `commandShell` / `scenes.open` /
+  `settings.subscribe` / 快捷键 dispatch / command-tree descriptions 等未验证
+  方法保持 degraded/staged。`Presentation` 的交互 `ask` 已桥接到真实
+  `QuestionStore`，`approve` 在 P3 明确 staged。
+- **生产 P3 slices 接入**：非 `legacy` 的 `TuiPluginHostRuntime` 会把
+  `ADAPTER_KERNEL_SLICES` 传入生产 `KernelRuntime`，进入 mount/refresh/
+  descriptor 流程；依赖的服务未挂载时对应 slice 降级而不是崩溃。
+  `DSH_TUI_ADAPTER_SLICES` 现在会按 slice id / capability / effect 矩阵过滤
+  kernel slices，不再是无效果的死参数。
+- **宿主初始化运行时快照**：所有 adapter/宿主服务（storage/message/plugin-host、
+  P3 的 status/workspaces/scenes/settings/toast/dialogs/command-trees/questions/approvals
+  等）都会在初始化时捕获不可变 `AdapterRuntimeOptions`。之后同一进程再修改
+  `DSH_TUI_ADAPTER_MODE` / `DSH_TUI_ADAPTER_SLICES` 不能把 passive/replay 服务
+  解锁成 `new`；能力入口不再每次读 `process.env`。
+- **Slice 归属与边界**：`DSH_TUI_ADAPTER_SLICES` 现在会大小写/空白归一化、支持
+  常见别名（如 `dialogs` → `presentation`、`decisions` → `decisions`），未知
+  slice id 直接拒绝并 fail-closed。`toast` 不再被 `presentation` 隐式加载，
+  `decisions` 不再被 `messages` 隐式加载。
+- **P4 Channel Port/投影层（诚实表述）**：新增 `projection / actions / state /
+  plugins / transcript` 五个 Host Port 与 `src/adapter/channel/*` 拆分模块，
+  并由 `channel` KernelSlice 挂载到生产 HostFacade；**生产 `src/dsh-adapter/channel.ts`
+  本体尚未物理拆分**，仍由 live Channel 作为实现来源，拆分模块是生产 driver
+  实际消费的 Port/投影层；**T1 已做核心迁移：生产 `plugin.ts` 中的通知与初始提交
+  已优先走 `HostFacade.channel.actions`；**非 shadow 模式下 facade 尚未 mount
+  时可回退原生 Channel，passive/replay shadow 下禁止回退，缺失或拒绝时丢弃**；
+  其余 UI/Channel 内部动作仍大部分直接调用原生 Channel，尚未完整迁移。
+  `HostFacade` 按方法做 shadow 守卫，passive/replay 下只读投影可用、变更动作被拒。
+- **P5 Channel Provider/Consumer**：新增本地 Channel Provider/Consumer，
+  实现 `tui.dsh/v1alpha1#Channel` 的 open/subscribe/invoke/close 协议包络与
+  规范校验；`runChannelReplay` 支持录制 snapshot 数组，也支持把真实 DSH
+  `agent.session.events` 形状事件投影为单调 `TuiChannelSnapshot`。该投影定位为
+  **minimal transcript replay**：覆盖 transcript/status/基础 session 字段，
+  并在调用方提供元数据时带入 model/mode/preset/settings/scene/diagnostic/trace/
+  context/pending/usage 等 RFC 相关字段；仍**不声明是完整 RFC 0007 Channel
+  state/conformance**。未知方法按协议失败、
+  features 必须显式声明且每个 feature 必须有 state/method 可观察证据、
+  重复 features 先拒绝、未知非 ignorable DSH event fail-closed、
+  method handler 只能在 replay isolation 内执行、replay provider 不解析
+  workspace/sessionId selector（显式 unsupported）；连续性错误 fail-closed。
+- **P3 feature 生命周期稳定性**：`refresh` 之后执行 `mount()` / `descriptorBuild()` /
+  `diagnosticSnapshot()` 再次触发同步 `detect()`，也不会清空已探测的 P3 feature；
+  这些 feature 是内部 Kernel/Port 事实，不进入公开 Host Descriptor。
+- **Settings section live 诚实性**：`host.settings.section` 的 live 依据是探针中
+  真实调用 `section()` 解析临时 namespace；解析缺失/失败时该 feature 降级，不再
+  仅凭 register/list 就标 live。
+- **Host Port 逐方法 shadow guard**：`KernelRuntime.facade()` 返回的每个
+  Port 方法都会先执行统一 effect-class 检查。passive/replay 生产模式下
+  `rename`、`runCommand`、`commandShell`、`scenes.open`、`settings.subscribe`、
+  各类 `register` 等会被拒绝；只读方法仍可用于诊断。
+- **Toast live probe** 使用独立 probe-only sink 管道，不替换/不吞并发生产
+  toast；**Status live probe** 在 `clearIf` 失败或残留时降级，不会标 live。
+- `verify:adapter-slices` / `verify:adapter-detection` 现在同时检查生产
+  plugin-host 确实传递 `ADAPTER_KERNEL_SLICES`，避免门禁只测直接 new
+  KernelRuntime 的自证。
 
 
 

package/bin/dsh-tui.js

@@ -183,7 +183,9 @@ const MSG = {
       profileNewer: v => `profile is newer — align the launcher:  npm install -g ${PACKAGE}@${v}`,
       profileOlder: v => `profile is older — align it:  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${v}`,
       keySet: 'set',
-      keyMissing: 'not set — interactive launch reads DEEPSEEK_API_KEY',
+      keySetEnv: 'set (environment)',
+      keySetStore: 'set (DSH credential store)',
+      keyMissing: 'not set — neither DEEPSEEK_API_KEY nor a DSH credential-store ref',
       missing: 'missing',
     },
     zh: {
@@ -194,7 +196,9 @@ const MSG = {
       profileNewer: v => `profile 较新——对齐启动器：  npm install -g ${PACKAGE}@${v}`,
       profileOlder: v => `profile 较旧——对齐它：  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${v}`,
       keySet: '已设置',
-      keyMissing: '未设置——交互启动读取 DEEPSEEK_API_KEY',
+      keySetEnv: '已设置（环境变量）',
+      keySetStore: '已设置（DSH 凭据库）',
+      keyMissing: '未设置——环境变量与 DSH 凭据库中都没有 DEEPSEEK_API_KEY',
       missing: '缺失',
     },
   },
@@ -271,6 +275,30 @@ if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
   console.log(msg('helpText'))
   process.exit(0)
 }
+/**
+ * Whether the DSH credential store declares a reference by this name.
+ *
+ * The launcher stays dependency-free, so the YAML is read as text: only the
+ * top-level `refs:` block maps reference names to stored secrets, and matching
+ * the bare name anywhere else (grants, payloads) would false-positive. Reports
+ * presence only — the value is never read, formatted, or printed. Mirrored by
+ * the in-TUI `/doctor` in src/utils/credentials.ts; the two must not diverge.
+ * @param home - The DSH home directory that holds `.credentials.yaml`.
+ * @param name - Reference name to look for (e.g. `DEEPSEEK_API_KEY`).
+ * @returns True when a `refs` entry with that name exists.
+ */
+const credentialRefDeclared = (home, name) => {
+  try {
+    const text = readFileSync(join(home, '.credentials.yaml'), 'utf8')
+    const block = /^refs:[ \t]*\r?\n((?:[ \t]+\S.*(?:\r?\n|$))*)/mu.exec(text)
+    if (block === null) return false
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')
+    return new RegExp(`^[ \t]+${escaped}[ \t]*:`, 'mu').test(block[1])
+  } catch {
+    return false
+  }
+}
+
 // ─── 子命令：doctor ──────────────────────────────────────────────────────────
 // 启动前环境诊断——针对「TUI 起不来」的故障域（装不上、update 后版本不
 // 同步、密钥没配），与 TUI 内 /doctor 的会话内诊断互补。零 lib 依赖、
@@ -316,10 +344,17 @@ if (subcommand === 'doctor') {
       }
     }
   }
-  // truthiness 而非 !== undefined：空字符串的 key 同样发不了请求，且 TUI 内
-  // /doctor（channel.doctorInfo）按 truthiness 报告——两个 doctor 不许分叉。
-  const keySet = Boolean(process.env.DEEPSEEK_API_KEY)
-  report(keySet, 'DEEPSEEK_API_KEY', keySet ? L.keySet : L.keyMissing)
+  // truthiness 而非 !== undefined：空字符串的 key 同样发不了请求。TUI 内
+  // /doctor（channel.doctorInfo）用同一判定——两个 doctor 不许分叉。
+  // 只看环境变量会误报：dsh 在启动时才把凭据库里的 ref 解析进会话，而
+  // doctor 跑在 dsh 之前，此时环境变量通常仍是空的。
+  const keyFromEnv = Boolean(process.env.DEEPSEEK_API_KEY)
+  const keyFromStore = credentialRefDeclared(dshHome, 'DEEPSEEK_API_KEY')
+  report(
+    keyFromEnv || keyFromStore,
+    'DEEPSEEK_API_KEY',
+    keyFromEnv ? L.keySetEnv : keyFromStore ? L.keySetStore : L.keyMissing,
+  )
   for (const candidate of [join(homedir(), '.dsh-tui', 'cordis.yml'), join(profileDir, 'cordis.patch.yml')]) {
     report(existsSync(candidate), 'config', `${candidate}${existsSync(candidate) ? '' : `  ${L.missing}`}`)
   }
@@ -389,6 +424,55 @@ const bootstrapProfile = () => {
   }
 }
 
+/** Installed version of the profile copy, or undefined when it is absent/unreadable. */
+const profileVersion = () => {
+  try {
+    return JSON.parse(readFileSync(installedPkgPath, 'utf8')).version
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Guard the launcher/profile version boundary. The two copies ship in the same
+ * npm package but are installed independently (`npm i -g` vs `dsh plugin add`),
+ * so one of them being upgraded alone is a normal state. It must be caught
+ * here: dsh composes the launcher's patch surface with the profile's packages,
+ * and a skew fails deep inside the dsh loader
+ * (`ERR_PACKAGE_PATH_NOT_EXPORTED` on a subpath the older copy does not
+ * export) instead of with a message the user can act on. Runs on the
+ * delegation path as well as the in-profile path, because the delegated child
+ * is itself the profile copy and can no longer see the outer launcher.
+ * @param installedVersion - The profile copy's version.
+ */
+const checkProfileAlignment = installedVersion => {
+  if (installedVersion === undefined || ownVersion === undefined || installedVersion === ownVersion) return
+  const majorMinor = v => v.split('-')[0].split('.').slice(0, 2).map(Number)
+  const [installedMajor, installedMinor] = majorMinor(installedVersion)
+  const [ownMajor, ownMinor] = majorMinor(ownVersion)
+  if (installedMajor < ownMajor || (installedMajor === ownMajor && installedMinor < ownMinor)) {
+    console.error(
+      `[dsh-tui] cannot start: the profile runs v${installedVersion} but this launcher is v${ownVersion}.\n` +
+        `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
+    )
+    process.exit(1)
+  }
+  if (isVersionNewer(installedVersion, ownVersion)) {
+    console.error(
+      `[dsh-tui] note: the profile is already v${installedVersion}; this launcher copy is v${ownVersion}.\n` +
+        `  npm install -g --legacy-peer-deps ${PACKAGE}@${installedVersion}\n` +
+        `(--legacy-peer-deps avoids an npm 12 peer-resolution crash, see issue #459)`,
+    )
+  } else {
+    // profile 更旧但同 minor（patch 级错位）：允许启动，指引用 add 把
+    // profile 对齐到启动器版本（精确版本，@latest 可能越过对齐点）。
+    console.error(
+      `[dsh-tui] note: the profile is running v${installedVersion} but this launcher is v${ownVersion}.\n` +
+        `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
+    )
+  }
+}
+
 // ─── 子命令：update ──────────────────────────────────────────────────────────
 // 顶层处理、两种角色同一条路径——不放进委托链。委托会把 update 交给
 // profile 内的旧 bin：旧副本不认识这个词，只会当参数透传，恰好是「profile
@@ -425,6 +509,10 @@ if (subcommand === 'update') {
 // 的沙箱用它直接驱动全量路径；现场排查委托链时同样可用）。
 if (!runningInsideProfile && ownVersion !== undefined && process.env.DSH_TUI_NO_DELEGATE !== '1') {
   if (!profileReady()) bootstrapProfile()
+  // Refuse to delegate into a profile from an older release line: the profile
+  // copy would launch `dsh --profile dsh-tui` against a composition built from
+  // this launcher's patch surface and fail inside the loader.
+  checkProfileAlignment(profileVersion())
   // 委托 profile 内副本执行全部启动逻辑。外层代际通过
   // DSH_TUI_LAUNCHER_VERSION 交代（/update 的对齐诊断沿用该契约）。
   try {
@@ -466,33 +554,11 @@ if (!runningInsideProfile && ownVersion !== undefined && process.env.DSH_TUI_NO_
       installedVersion = undefined
     }
   }
-  if (installedVersion !== undefined && ownVersion !== undefined && installedVersion !== ownVersion && !runningInsideProfile) {
-    const majorMinor = v => v.split('-')[0].split('.').slice(0, 2).map(Number)
-    const [installedMajor, installedMinor] = majorMinor(installedVersion)
-    const [ownMajor, ownMinor] = majorMinor(ownVersion)
-    if (installedMajor < ownMajor || (installedMajor === ownMajor && installedMinor < ownMinor)) {
-      console.error(
-        `[dsh-tui] cannot start: the profile runs v${installedVersion} but this launcher is v${ownVersion}.\n` +
-          `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
-      )
-      process.exit(1)
-    }
-    const installedNewer = installedVersion !== undefined && ownVersion !== undefined && isVersionNewer(installedVersion, ownVersion)
-    if (installedNewer) {
-      console.error(
-        `[dsh-tui] note: the profile is already v${installedVersion}; this launcher copy is v${ownVersion}.\n` +
-          `  npm install -g --legacy-peer-deps ${PACKAGE}@${installedVersion}\n` +
-          `(--legacy-peer-deps avoids an npm 12 peer-resolution crash, see issue #459)`,
-      )
-    } else {
-      // profile 更旧但同 minor（patch 级错位）：允许启动，指引用 add 把
-      // profile 对齐到启动器版本（精确版本，@latest 可能越过对齐点）。
-      console.error(
-        `[dsh-tui] note: the profile is running v${installedVersion} but this launcher is v${ownVersion}.\n` +
-          `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
-      )
-    }
-  }
+  // 版本错位诊断与瘦壳委托路径共用同一实现（见 checkProfileAlignment）。
+  // `!runningInsideProfile` 只在 DSH_TUI_NO_DELEGATE=1 的调试口下成立，因此
+  // 该判定不能只留在这里——委派出去的子进程就是 profile 副本，看不到外层
+  // 启动器版本。
+  if (!runningInsideProfile) checkProfileAlignment(installedVersion)
 
   // --resume / 工作区目标拦截（launcher 契约，见 src/sessionHistory.ts）。
   const setResumeEnv = sessionId => {

package/cordis.patch.yml

@@ -12,10 +12,27 @@
 # ── surface-specific values over the dsh-base layer ─────────────────────────
 
 # The dsh-tui deployment persona; DSH_TUI_PERSONA overrides the coding-agent
-# default (the base persona is empty).
+# default (the base persona is empty). dsh-system-prompt renamed the slot at
+# 0.1.3-alpha.2 (`persona` → `personaPrefix`, with an optional suffix
+# counterpart); older cohorts only accept `persona`, so the key follows the
+# installed package version.
 - id: system-prompt
-  config:
-    persona: !!js process.env.DSH_TUI_PERSONA ?? 'You are a coding agent.'
+  config: !!js >-
+    (() => {
+      const persona = process.env.DSH_TUI_PERSONA ?? 'You are a coding agent.'
+      try {
+        const require = process.getBuiltinModule('node:module').createRequire(ctx.baseUrl)
+        const fs = process.getBuiltinModule('node:fs')
+        const manifest = require.resolve('@deepseek-ai/dsh-system-prompt/package.json')
+        const version = String(JSON.parse(fs.readFileSync(manifest, 'utf8')).version ?? '')
+        const match = /^(\d+)\.(\d+)\.(\d+)/u.exec(version)
+        const [major, minor, patch] = match === null ? [0, 0, 0] : [Number(match[1]), Number(match[2]), Number(match[3])]
+        if (major > 0 || minor > 1 || (minor === 1 && patch >= 3)) return { personaPrefix: persona }
+        return { persona }
+      } catch {
+        return { personaPrefix: persona }
+      }
+    })()
 
 # The native DeepSeek adapter, pinned to the harness defaults: full thinking
 # at max effort, key and base URL from the launching environment. The base
@@ -141,8 +158,11 @@
 - id: tool-skill
   disabled: true
 
-- id: tool-str-replace-editor
-  disabled: true
+# `tool-str-replace-editor` carries no disable row: dsh-base registered that
+# entry only up to the 0.1.2 line, and from 0.1.3-alpha.2 it is opt-in (see the
+# dsh-base README). A row here would target a missing id and log
+# `patch: entry "tool-str-replace-editor" not found` on every 0.1.3+ boot.
+# Presets that expose the tool re-add the entry themselves.
 
 # Delegation tools (subagent spawn/fork, controls, workflows) are preset rows
 # now; the preset's `delegation` group re-adds them with package defaults, so

package/lib/types/adapter/channel/actions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Channel actions module (P4 channel split).
+ *
+ * This is the action half of the live Channel: a thin adapter over the
+ * public Channel mutation methods. The Kernel HostFacade wraps these methods
+ * with the unified shadow-policy enforcement before any caller can invoke
+ * them, so this module never performs its own shadow check.
+ *
+ * The internal `CHANNEL_SPLIT_TOKEN` is required to prevent arbitrary TUI
+ * code from importing this split builder directly and bypassing the
+ * HostFacade shadow gate.
+ */
+import type { Channel } from '../../dsh-adapter/channel.js';
+import type { HostChannelActionsPort } from '../ports/channel.js';
+/** Build the host-internal action surface over one live Channel. */
+export declare function createChannelActions(channel: Channel, token: symbol): HostChannelActionsPort;
+//# sourceMappingURL=actions.d.ts.map

package/lib/types/adapter/channel/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAGjE,oEAAoE;AACpE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAaxB"}

package/lib/types/adapter/channel/actions.js

@@ -0,0 +1,28 @@
+/**
+ * Channel actions module (P4 channel split).
+ *
+ * This is the action half of the live Channel: a thin adapter over the
+ * public Channel mutation methods. The Kernel HostFacade wraps these methods
+ * with the unified shadow-policy enforcement before any caller can invoke
+ * them, so this module never performs its own shadow check.
+ *
+ * The internal `CHANNEL_SPLIT_TOKEN` is required to prevent arbitrary TUI
+ * code from importing this split builder directly and bypassing the
+ * HostFacade shadow gate.
+ */
+import { CHANNEL_SPLIT_TOKEN } from './internal-token.js';
+/** Build the host-internal action surface over one live Channel. */
+export function createChannelActions(channel, token) {
+    if (token !== CHANNEL_SPLIT_TOKEN) {
+        throw new Error('dsh-tui: Channel split actions require the internal host token');
+    }
+    return Object.freeze({
+        submit: text => channel.submit(text),
+        steer: text => channel.steer(text),
+        cancel: () => channel.cancel(),
+        interruptAndDeliver: texts => channel.interruptAndDeliver(texts),
+        clear: () => channel.clear(),
+        loadOlder: () => channel.loadOlder(),
+        notify: (text, options) => channel.notify(text, options),
+    });
+}

package/lib/types/adapter/channel/consumer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * TUI Channel Consumer (P5).
+ *
+ * A Channel Consumer owns the visible terminal side of
+ * `tui.dsh/v1alpha1#Channel`. This module is the conformance-facing client:
+ * it opens a provider, subscribes to snapshots, enforces monotonic versions
+ * and full-snapshot continuity, invokes JSON-value methods, and closes the
+ * channel. It never interprets provider business methods itself.
+ *
+ * Continuity violations are fail-closed by default: the consumer throws
+ * instead of silently retaining a discontinuous snapshot.
+ */
+import type { TuiChannelInvokeOutput, TuiChannelSnapshot } from '../spec/index.js';
+import type { ChannelProvider, ChannelProviderOpenInput } from './provider.js';
+export interface ChannelConsumerOptions {
+    /** When true (default), a continuity violation throws immediately and the
+     * discontinuous snapshot is not retained. */
+    readonly failClosed?: boolean;
+}
+export interface ChannelConsumer {
+    open(input: ChannelProviderOpenInput): Promise<TuiChannelSnapshot>;
+    subscribe(channelId: string, afterVersion: number, listener: (snapshot: TuiChannelSnapshot) => void): Promise<() => void>;
+    invoke(channelId: string, method: string, args: readonly unknown[]): Promise<TuiChannelInvokeOutput>;
+    close(channelId: string): Promise<{
+        readonly closed: true;
+    }>;
+    lastSnapshot(): TuiChannelSnapshot | undefined;
+    /** Version continuity failures observed while consuming (gap/backwards/
+     * wire-revision change). A conformant replay must keep this empty. */
+    continuityErrors(): readonly string[];
+}
+/** Wrap a Channel Provider with the consumer-side protocol envelope checks. */
+export declare function createChannelConsumer(provider: ChannelProvider, options?: ChannelConsumerOptions): ChannelConsumer;
+//# sourceMappingURL=consumer.d.ts.map

package/lib/types/adapter/channel/consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAE9E,MAAM,WAAW,sBAAsB;IACrC;iDAC6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAClE,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,GAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;IACtB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACpG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC5D,YAAY,IAAI,kBAAkB,GAAG,SAAS,CAAA;IAC9C;0EACsE;IACtE,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAqEjB"}

package/lib/types/adapter/channel/consumer.js

@@ -0,0 +1,87 @@
+/**
+ * TUI Channel Consumer (P5).
+ *
+ * A Channel Consumer owns the visible terminal side of
+ * `tui.dsh/v1alpha1#Channel`. This module is the conformance-facing client:
+ * it opens a provider, subscribes to snapshots, enforces monotonic versions
+ * and full-snapshot continuity, invokes JSON-value methods, and closes the
+ * channel. It never interprets provider business methods itself.
+ *
+ * Continuity violations are fail-closed by default: the consumer throws
+ * instead of silently retaining a discontinuous snapshot.
+ */
+import { validateTuiChannelOutput, validateTuiChannelSnapshot } from '../spec/index.js';
+/** Wrap a Channel Provider with the consumer-side protocol envelope checks. */
+export function createChannelConsumer(provider, options = {}) {
+    const failClosed = options.failClosed !== false;
+    let last;
+    const continuityErrors = [];
+    function accept(snapshotValue, allowEqual = false) {
+        const snapshot = validateTuiChannelSnapshot(snapshotValue);
+        const errorCountBefore = continuityErrors.length;
+        if (last !== undefined) {
+            if (snapshot.channelId !== last.channelId) {
+                continuityErrors.push(`channel id changed: ${last.channelId} -> ${snapshot.channelId}`);
+            }
+            else if (snapshot.wireRevision !== last.wireRevision) {
+                continuityErrors.push(`wire revision changed: ${last.wireRevision} -> ${snapshot.wireRevision}`);
+            }
+            else if (snapshot.version < last.version) {
+                continuityErrors.push(`version went backwards: ${last.version} -> ${snapshot.version}`);
+            }
+            else if (snapshot.version === last.version && !allowEqual) {
+                continuityErrors.push(`version did not advance: ${last.version} -> ${snapshot.version}`);
+            }
+            else if (snapshot.version > last.version && snapshot.version !== last.version + 1) {
+                continuityErrors.push(`version gap: expected ${last.version + 1}, got ${snapshot.version}`);
+            }
+        }
+        const hasNewError = continuityErrors.length > errorCountBefore;
+        if (hasNewError && failClosed) {
+            throw new Error(`dsh-tui: Channel continuity violation: ${continuityErrors[continuityErrors.length - 1]}`);
+        }
+        // When not fail-closed, keep advancing `last` to the snapshot that was
+        // actually observed so later continuity messages describe the real
+        // sequence rather than a stale pre-violation baseline.
+        if (last === undefined || snapshot.version >= last.version) {
+            last = snapshot;
+        }
+        return snapshot;
+    }
+    return Object.freeze({
+        async open(input) {
+            const snapshot = await provider.open(input);
+            last = undefined;
+            continuityErrors.length = 0;
+            return accept(snapshot);
+        },
+        async subscribe(channelId, afterVersion, listener) {
+            let firstReplay = true;
+            return provider.subscribe(channelId, afterVersion, value => {
+                // Provider semantics are "not earlier than afterVersion": an equal
+                // version echo after `open()` is the first snapshot of a subscription
+                // and must be accepted, while later equal-version duplicates still
+                // violate continuity.
+                listener(accept(value, firstReplay));
+                firstReplay = false;
+            });
+        },
+        async invoke(channelId, method, args) {
+            const output = await provider.invoke(channelId, method, args);
+            const validated = validateTuiChannelOutput('invoke', output);
+            if (validated.snapshot !== undefined)
+                accept(validated.snapshot, true);
+            return validated;
+        },
+        async close(channelId) {
+            const output = await provider.close(channelId);
+            return validateTuiChannelOutput('close', output);
+        },
+        lastSnapshot() {
+            return last;
+        },
+        continuityErrors() {
+            return Object.freeze([...continuityErrors]);
+        },
+    });
+}

package/lib/types/adapter/channel/features.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared Channel Host-Port effect-capability map and derived feature list.
+ *
+ * This is the single source that `HostFacade` shadow policy, the Channel
+ * upstream driver and the Kernel channel slice all consume. Keeping it here
+ * prevents the slice declaration / driver feature list from drifting from the
+ * methods actually exposed by `HostChannelPort`.
+ */
+export declare const CHANNEL_PORT_METHOD_CAPABILITIES: Readonly<Record<string, Readonly<Record<string, string>>>>;
+export declare const CHANNEL_FEATURES: readonly string[];
+export declare const CHANNEL_STANDARD_DECLARATIONS: readonly string[];
+//# sourceMappingURL=features.d.ts.map

package/lib/types/adapter/channel/features.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/features.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CA6BtG,CAAA;AAEF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAK7C,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAAqB,CAAA"}

package/lib/types/adapter/channel/features.js

@@ -0,0 +1,41 @@
+/**
+ * Shared Channel Host-Port effect-capability map and derived feature list.
+ *
+ * This is the single source that `HostFacade` shadow policy, the Channel
+ * upstream driver and the Kernel channel slice all consume. Keeping it here
+ * prevents the slice declaration / driver feature list from drifting from the
+ * methods actually exposed by `HostChannelPort`.
+ */
+export const CHANNEL_PORT_METHOD_CAPABILITIES = Object.freeze({
+    projection: Object.freeze({
+        ui: 'host.channel.projection.ui',
+        snapshot: 'host.channel.projection.snapshot',
+        subscribe: 'host.channel.projection.subscribe',
+    }),
+    actions: Object.freeze({
+        submit: 'host.channel.actions.submit',
+        steer: 'host.channel.actions.steer',
+        cancel: 'host.channel.actions.cancel',
+        interruptAndDeliver: 'host.channel.actions.interruptAndDeliver',
+        clear: 'host.channel.actions.clear',
+        loadOlder: 'host.channel.actions.loadOlder',
+        notify: 'host.channel.actions.notify',
+    }),
+    state: Object.freeze({
+        snapshot: 'host.channel.state.snapshot',
+    }),
+    plugins: Object.freeze({
+        runExternalCommand: 'host.channel.plugins.run-external-command',
+        openPluginScene: 'host.channel.plugins.open-scene',
+        closePluginScene: 'host.channel.plugins.close-scene',
+        settingsSections: 'host.channel.plugins.settings-sections',
+        subscribeSettingsSections: 'host.channel.plugins.subscribe-settings-sections',
+    }),
+    transcript: Object.freeze({
+        rows: 'host.channel.transcript.rows',
+        traceEvents: 'host.channel.transcript.trace-events',
+    }),
+});
+export const CHANNEL_FEATURES = Object.freeze([...new Set(Object.values(CHANNEL_PORT_METHOD_CAPABILITIES)
+        .flatMap(subPort => Object.values(subPort)))]);
+export const CHANNEL_STANDARD_DECLARATIONS = CHANNEL_FEATURES;