@deepseek-harness-tui/dsh-tui 0.10.0 → 0.10.2

package/README.md

@@ -67,8 +67,10 @@ Sixel 使用最多 256 色的自适应调色板，透明像素与背景合成；
     用户附图及助手/工具结果中的持久图片块会直接显示在会话记录中；Kitty graphics 或 Sixel 可用时显示等比缩略图，否则保留同尺寸文字回退。全屏下点击输入框 `[Image #N]` 或 transcript 缩略图在对话区域居中打开大图预览，卡片外的对话文字变暗，不遮挡输入栏（Esc/点击外部关闭），标题为 `Image #N — 格式 · 尺寸 · 体积 · 文件名`，本会话暂存的图片在卡片底行显示来源路径；Finder 复制的图片文件粘贴时直接入附件库为 `[Image #N]`；输入框里的 `[Image #N]` 是一个整体，光标整体跳过、删除整体生效，光标落在其上时整块反显并自动打开预览、离开时关闭。Vim 的 `x`/`X`/`d…` 同样整张删除，`u` 同时恢复文字与附件；撤销仅限当前草稿。
     终端图片预览默认开启，可在 `/settings → 终端图片预览` 或配置 `terminalImages: false` 中关闭，使用 `/restart` 后生效。已保存的 `/settings` 选择优先于 Cordis 配置；若曾保存为开启，请在 `/settings` 中关闭后再 `/restart`。关闭时保留文字信息并跳过预览解码，不影响向模型发送图片；`DSH_TUI_DISABLE_TERMINAL_IMAGES=1` 始终强制关闭预览。
   - **功能全面**：`/resume` 按工作目录分类浏览、搜索与预览历史会话（左键恢复、右键弹出操作菜单；可固定常用会话——「已固定」分组置顶显示，行内 ★ 或 `Ctrl+P` 切换，持久化到 `~/.dsh-tui`），另有 `/agentview` 会话总览（空输入 `←` 一键后台化，后台会话派发、预览、回复与停止一站式管理）、`/new`、`/compact`、`/export`、`/btw`，模型热切换（新会话默认推理强度可在 /settings → 默认推理强度 预设），原生subagent，会话fork，自动更新，输入框 `/vim` vim 编辑模式、鼠标选区编辑（拖选高亮、Shift+click 扩展、双击选词、Ctrl+C 复制选区）与全屏草稿编辑（`Ctrl+Shift+E` 或输入行 `⛶` 按钮：行号 + 当前行高亮、Enter 换行、Ctrl+Enter 发送、滚轮滚动、点击/拖选，长草稿独占整屏；`/settings` 可关）；可在vs code中[以vscode插件形式启动](docs/vscode.md)，已上架 VS Code Marketplace。
+    `/resume` 只将完整读取并确认没有用户消息的日志判为空会话；仅发图片、读取不完整或解析失败的会话不会被归入空会话清理。
   - **扩展丰富**：原生浏览器交互，compter use等大量附属功能性扩展
   - **技能归 DSH 管理**：`/skills` 展示当前 profile、用户与项目发现的技能；dsh-TUI 不预装通用技能。
+    技能目录暂时不完整时，保留最后一次完整观测的技能菜单与命令注册，并按 800/1600/3200ms 最多重试三次；耗尽后等待 DSH 的 `skills/change` 通知或显式刷新，不持续轮询。只有完整观测才能移除已消失的技能，包括完整空目录。
   - **工作状态动画**：默认使用 `moon8`；读取旧版本地配置中的 `claude` 值时自动映射为 `moon8`，选择器只显示当前预设。
   - **像素鲸鱼娘**：开屏随机三选一开场动画；欢迎期（开始第一个任务前）可**点击冒爱心并唤醒睡着的鲸鱼**，闲置时摆鱼鳍、拍尾巴、入睡冒 Z（`/settings → whaleIdle` 可关）。**开始第一个任务后永久定格为静态标准帧**，零持续开销。鲸鱼娘的 22 帧手绘原图与闲置行为移植自 [dsh-ui-whale](https://github.com/lhh010/dsh-ui-whale)（作者 [@lhh010](https://github.com/lhh010)），特此致谢。
 
@@ -150,8 +152,9 @@ sh install.sh
 | 实验性（仍可能随 dsh-std / 准入规范演进调整） | 九 决策事件 · toast 通知（`ctx.tuiToast`，新增） |
 | 跟随上游（稳定性由 cordis / dsh 官方机制决定） | 一 会话事件 · 二 官方 prompt 槽位 · 三 技能打包 · 四 主题 · 五 system prompt 段 · 七 profile 组合 |
 
-另：`@deepseek-harness-tui/dsh-tui/test-utils`（headless 准入/挂载测试助手）与
-`@deepseek-harness-tui/dsh-tui/api`（纯类型入口）为实验性公开面。
+另：`@deepseek-harness-tui/dsh-tui/api`（纯类型入口）为实验性公开面；
+`@deepseek-harness-tui/dsh-tui/test-utils` 子路径与 `ctx.tuiPluginHost.grants.corrupt`
+已随 adapter 分层重构（#705）移除，`grants` 收窄为 `HostGrantFacade`，迁移细节见该 PR。
 
 
 

package/bin/dsh-tui.js

@@ -183,7 +183,9 @@ const MSG = {
       profileNewer: v => `profile is newer — align the launcher:  npm install -g ${PACKAGE}@${v}`,
       profileOlder: v => `profile is older — align it:  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${v}`,
       keySet: 'set',
-      keyMissing: 'not set — interactive launch reads DEEPSEEK_API_KEY',
+      keySetEnv: 'set (environment)',
+      keySetStore: 'set (DSH credential store)',
+      keyMissing: 'not set — neither DEEPSEEK_API_KEY nor a DSH credential-store ref',
       missing: 'missing',
     },
     zh: {
@@ -194,7 +196,9 @@ const MSG = {
       profileNewer: v => `profile 较新——对齐启动器：  npm install -g ${PACKAGE}@${v}`,
       profileOlder: v => `profile 较旧——对齐它：  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${v}`,
       keySet: '已设置',
-      keyMissing: '未设置——交互启动读取 DEEPSEEK_API_KEY',
+      keySetEnv: '已设置（环境变量）',
+      keySetStore: '已设置（DSH 凭据库）',
+      keyMissing: '未设置——环境变量与 DSH 凭据库中都没有 DEEPSEEK_API_KEY',
       missing: '缺失',
     },
   },
@@ -271,6 +275,30 @@ if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
   console.log(msg('helpText'))
   process.exit(0)
 }
+/**
+ * Whether the DSH credential store declares a reference by this name.
+ *
+ * The launcher stays dependency-free, so the YAML is read as text: only the
+ * top-level `refs:` block maps reference names to stored secrets, and matching
+ * the bare name anywhere else (grants, payloads) would false-positive. Reports
+ * presence only — the value is never read, formatted, or printed. Mirrored by
+ * the in-TUI `/doctor` in src/utils/credentials.ts; the two must not diverge.
+ * @param home - The DSH home directory that holds `.credentials.yaml`.
+ * @param name - Reference name to look for (e.g. `DEEPSEEK_API_KEY`).
+ * @returns True when a `refs` entry with that name exists.
+ */
+const credentialRefDeclared = (home, name) => {
+  try {
+    const text = readFileSync(join(home, '.credentials.yaml'), 'utf8')
+    const block = /^refs:[ \t]*\r?\n((?:[ \t]+\S.*(?:\r?\n|$))*)/mu.exec(text)
+    if (block === null) return false
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')
+    return new RegExp(`^[ \t]+${escaped}[ \t]*:`, 'mu').test(block[1])
+  } catch {
+    return false
+  }
+}
+
 // ─── 子命令：doctor ──────────────────────────────────────────────────────────
 // 启动前环境诊断——针对「TUI 起不来」的故障域（装不上、update 后版本不
 // 同步、密钥没配），与 TUI 内 /doctor 的会话内诊断互补。零 lib 依赖、
@@ -316,10 +344,17 @@ if (subcommand === 'doctor') {
       }
     }
   }
-  // truthiness 而非 !== undefined：空字符串的 key 同样发不了请求，且 TUI 内
-  // /doctor（channel.doctorInfo）按 truthiness 报告——两个 doctor 不许分叉。
-  const keySet = Boolean(process.env.DEEPSEEK_API_KEY)
-  report(keySet, 'DEEPSEEK_API_KEY', keySet ? L.keySet : L.keyMissing)
+  // truthiness 而非 !== undefined：空字符串的 key 同样发不了请求。TUI 内
+  // /doctor（channel.doctorInfo）用同一判定——两个 doctor 不许分叉。
+  // 只看环境变量会误报：dsh 在启动时才把凭据库里的 ref 解析进会话，而
+  // doctor 跑在 dsh 之前，此时环境变量通常仍是空的。
+  const keyFromEnv = Boolean(process.env.DEEPSEEK_API_KEY)
+  const keyFromStore = credentialRefDeclared(dshHome, 'DEEPSEEK_API_KEY')
+  report(
+    keyFromEnv || keyFromStore,
+    'DEEPSEEK_API_KEY',
+    keyFromEnv ? L.keySetEnv : keyFromStore ? L.keySetStore : L.keyMissing,
+  )
   for (const candidate of [join(homedir(), '.dsh-tui', 'cordis.yml'), join(profileDir, 'cordis.patch.yml')]) {
     report(existsSync(candidate), 'config', `${candidate}${existsSync(candidate) ? '' : `  ${L.missing}`}`)
   }
@@ -389,6 +424,55 @@ const bootstrapProfile = () => {
   }
 }
 
+/** Installed version of the profile copy, or undefined when it is absent/unreadable. */
+const profileVersion = () => {
+  try {
+    return JSON.parse(readFileSync(installedPkgPath, 'utf8')).version
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Guard the launcher/profile version boundary. The two copies ship in the same
+ * npm package but are installed independently (`npm i -g` vs `dsh plugin add`),
+ * so one of them being upgraded alone is a normal state. It must be caught
+ * here: dsh composes the launcher's patch surface with the profile's packages,
+ * and a skew fails deep inside the dsh loader
+ * (`ERR_PACKAGE_PATH_NOT_EXPORTED` on a subpath the older copy does not
+ * export) instead of with a message the user can act on. Runs on the
+ * delegation path as well as the in-profile path, because the delegated child
+ * is itself the profile copy and can no longer see the outer launcher.
+ * @param installedVersion - The profile copy's version.
+ */
+const checkProfileAlignment = installedVersion => {
+  if (installedVersion === undefined || ownVersion === undefined || installedVersion === ownVersion) return
+  const majorMinor = v => v.split('-')[0].split('.').slice(0, 2).map(Number)
+  const [installedMajor, installedMinor] = majorMinor(installedVersion)
+  const [ownMajor, ownMinor] = majorMinor(ownVersion)
+  if (installedMajor < ownMajor || (installedMajor === ownMajor && installedMinor < ownMinor)) {
+    console.error(
+      `[dsh-tui] cannot start: the profile runs v${installedVersion} but this launcher is v${ownVersion}.\n` +
+        `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
+    )
+    process.exit(1)
+  }
+  if (isVersionNewer(installedVersion, ownVersion)) {
+    console.error(
+      `[dsh-tui] note: the profile is already v${installedVersion}; this launcher copy is v${ownVersion}.\n` +
+        `  npm install -g --legacy-peer-deps ${PACKAGE}@${installedVersion}\n` +
+        `(--legacy-peer-deps avoids an npm 12 peer-resolution crash, see issue #459)`,
+    )
+  } else {
+    // profile 更旧但同 minor（patch 级错位）：允许启动，指引用 add 把
+    // profile 对齐到启动器版本（精确版本，@latest 可能越过对齐点）。
+    console.error(
+      `[dsh-tui] note: the profile is running v${installedVersion} but this launcher is v${ownVersion}.\n` +
+        `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
+    )
+  }
+}
+
 // ─── 子命令：update ──────────────────────────────────────────────────────────
 // 顶层处理、两种角色同一条路径——不放进委托链。委托会把 update 交给
 // profile 内的旧 bin：旧副本不认识这个词，只会当参数透传，恰好是「profile
@@ -425,6 +509,10 @@ if (subcommand === 'update') {
 // 的沙箱用它直接驱动全量路径；现场排查委托链时同样可用）。
 if (!runningInsideProfile && ownVersion !== undefined && process.env.DSH_TUI_NO_DELEGATE !== '1') {
   if (!profileReady()) bootstrapProfile()
+  // Refuse to delegate into a profile from an older release line: the profile
+  // copy would launch `dsh --profile dsh-tui` against a composition built from
+  // this launcher's patch surface and fail inside the loader.
+  checkProfileAlignment(profileVersion())
   // 委托 profile 内副本执行全部启动逻辑。外层代际通过
   // DSH_TUI_LAUNCHER_VERSION 交代（/update 的对齐诊断沿用该契约）。
   try {
@@ -466,33 +554,11 @@ if (!runningInsideProfile && ownVersion !== undefined && process.env.DSH_TUI_NO_
       installedVersion = undefined
     }
   }
-  if (installedVersion !== undefined && ownVersion !== undefined && installedVersion !== ownVersion && !runningInsideProfile) {
-    const majorMinor = v => v.split('-')[0].split('.').slice(0, 2).map(Number)
-    const [installedMajor, installedMinor] = majorMinor(installedVersion)
-    const [ownMajor, ownMinor] = majorMinor(ownVersion)
-    if (installedMajor < ownMajor || (installedMajor === ownMajor && installedMinor < ownMinor)) {
-      console.error(
-        `[dsh-tui] cannot start: the profile runs v${installedVersion} but this launcher is v${ownVersion}.\n` +
-          `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
-      )
-      process.exit(1)
-    }
-    const installedNewer = installedVersion !== undefined && ownVersion !== undefined && isVersionNewer(installedVersion, ownVersion)
-    if (installedNewer) {
-      console.error(
-        `[dsh-tui] note: the profile is already v${installedVersion}; this launcher copy is v${ownVersion}.\n` +
-          `  npm install -g --legacy-peer-deps ${PACKAGE}@${installedVersion}\n` +
-          `(--legacy-peer-deps avoids an npm 12 peer-resolution crash, see issue #459)`,
-      )
-    } else {
-      // profile 更旧但同 minor（patch 级错位）：允许启动，指引用 add 把
-      // profile 对齐到启动器版本（精确版本，@latest 可能越过对齐点）。
-      console.error(
-        `[dsh-tui] note: the profile is running v${installedVersion} but this launcher is v${ownVersion}.\n` +
-          `  dsh plugin --profile ${PROFILE} add ${PACKAGE}@${ownVersion}`,
-      )
-    }
-  }
+  // 版本错位诊断与瘦壳委托路径共用同一实现（见 checkProfileAlignment）。
+  // `!runningInsideProfile` 只在 DSH_TUI_NO_DELEGATE=1 的调试口下成立，因此
+  // 该判定不能只留在这里——委派出去的子进程就是 profile 副本，看不到外层
+  // 启动器版本。
+  if (!runningInsideProfile) checkProfileAlignment(installedVersion)
 
   // --resume / 工作区目标拦截（launcher 契约，见 src/sessionHistory.ts）。
   const setResumeEnv = sessionId => {

package/cordis.patch.yml

@@ -12,10 +12,27 @@
 # ── surface-specific values over the dsh-base layer ─────────────────────────
 
 # The dsh-tui deployment persona; DSH_TUI_PERSONA overrides the coding-agent
-# default (the base persona is empty).
+# default (the base persona is empty). dsh-system-prompt renamed the slot at
+# 0.1.3-alpha.2 (`persona` → `personaPrefix`, with an optional suffix
+# counterpart); older cohorts only accept `persona`, so the key follows the
+# installed package version.
 - id: system-prompt
-  config:
-    persona: !!js process.env.DSH_TUI_PERSONA ?? 'You are a coding agent.'
+  config: !!js >-
+    (() => {
+      const persona = process.env.DSH_TUI_PERSONA ?? 'You are a coding agent.'
+      try {
+        const require = process.getBuiltinModule('node:module').createRequire(ctx.baseUrl)
+        const fs = process.getBuiltinModule('node:fs')
+        const manifest = require.resolve('@deepseek-ai/dsh-system-prompt/package.json')
+        const version = String(JSON.parse(fs.readFileSync(manifest, 'utf8')).version ?? '')
+        const match = /^(\d+)\.(\d+)\.(\d+)/u.exec(version)
+        const [major, minor, patch] = match === null ? [0, 0, 0] : [Number(match[1]), Number(match[2]), Number(match[3])]
+        if (major > 0 || minor > 1 || (minor === 1 && patch >= 3)) return { personaPrefix: persona }
+        return { persona }
+      } catch {
+        return { personaPrefix: persona }
+      }
+    })()
 
 # The native DeepSeek adapter, pinned to the harness defaults: full thinking
 # at max effort, key and base URL from the launching environment. The base
@@ -141,8 +158,11 @@
 - id: tool-skill
   disabled: true
 
-- id: tool-str-replace-editor
-  disabled: true
+# `tool-str-replace-editor` carries no disable row: dsh-base registered that
+# entry only up to the 0.1.2 line, and from 0.1.3-alpha.2 it is opt-in (see the
+# dsh-base README). A row here would target a missing id and log
+# `patch: entry "tool-str-replace-editor" not found` on every 0.1.3+ boot.
+# Presets that expose the tool re-add the entry themselves.
 
 # Delegation tools (subagent spawn/fork, controls, workflows) are preset rows
 # now; the preset's `delegation` group re-adds them with package defaults, so

package/lib/types/adapter/channel/actions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Channel actions module (P4 channel split).
+ *
+ * This is the action half of the live Channel: a thin adapter over the
+ * public Channel mutation methods. The Kernel HostFacade wraps these methods
+ * with the unified shadow-policy enforcement before any caller can invoke
+ * them, so this module never performs its own shadow check.
+ *
+ * The internal `CHANNEL_SPLIT_TOKEN` is required to prevent arbitrary TUI
+ * code from importing this split builder directly and bypassing the
+ * HostFacade shadow gate.
+ */
+import type { Channel } from '../../dsh-adapter/channel.js';
+import type { HostChannelActionsPort } from '../ports/channel.js';
+/** Build the host-internal action surface over one live Channel. */
+export declare function createChannelActions(channel: Channel, token: symbol): HostChannelActionsPort;
+//# sourceMappingURL=actions.d.ts.map

package/lib/types/adapter/channel/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAGjE,oEAAoE;AACpE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAaxB"}

package/lib/types/adapter/channel/actions.js

@@ -0,0 +1,28 @@
+/**
+ * Channel actions module (P4 channel split).
+ *
+ * This is the action half of the live Channel: a thin adapter over the
+ * public Channel mutation methods. The Kernel HostFacade wraps these methods
+ * with the unified shadow-policy enforcement before any caller can invoke
+ * them, so this module never performs its own shadow check.
+ *
+ * The internal `CHANNEL_SPLIT_TOKEN` is required to prevent arbitrary TUI
+ * code from importing this split builder directly and bypassing the
+ * HostFacade shadow gate.
+ */
+import { CHANNEL_SPLIT_TOKEN } from './internal-token.js';
+/** Build the host-internal action surface over one live Channel. */
+export function createChannelActions(channel, token) {
+    if (token !== CHANNEL_SPLIT_TOKEN) {
+        throw new Error('dsh-tui: Channel split actions require the internal host token');
+    }
+    return Object.freeze({
+        submit: text => channel.submit(text),
+        steer: text => channel.steer(text),
+        cancel: () => channel.cancel(),
+        interruptAndDeliver: texts => channel.interruptAndDeliver(texts),
+        clear: () => channel.clear(),
+        loadOlder: () => channel.loadOlder(),
+        notify: (text, options) => channel.notify(text, options),
+    });
+}

package/lib/types/adapter/channel/consumer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * TUI Channel Consumer (P5).
+ *
+ * A Channel Consumer owns the visible terminal side of
+ * `tui.dsh/v1alpha1#Channel`. This module is the conformance-facing client:
+ * it opens a provider, subscribes to snapshots, enforces monotonic versions
+ * and full-snapshot continuity, invokes JSON-value methods, and closes the
+ * channel. It never interprets provider business methods itself.
+ *
+ * Continuity violations are fail-closed by default: the consumer throws
+ * instead of silently retaining a discontinuous snapshot.
+ */
+import type { TuiChannelInvokeOutput, TuiChannelSnapshot } from '../spec/index.js';
+import type { ChannelProvider, ChannelProviderOpenInput } from './provider.js';
+export interface ChannelConsumerOptions {
+    /** When true (default), a continuity violation throws immediately and the
+     * discontinuous snapshot is not retained. */
+    readonly failClosed?: boolean;
+}
+export interface ChannelConsumer {
+    open(input: ChannelProviderOpenInput): Promise<TuiChannelSnapshot>;
+    subscribe(channelId: string, afterVersion: number, listener: (snapshot: TuiChannelSnapshot) => void): Promise<() => void>;
+    invoke(channelId: string, method: string, args: readonly unknown[]): Promise<TuiChannelInvokeOutput>;
+    close(channelId: string): Promise<{
+        readonly closed: true;
+    }>;
+    lastSnapshot(): TuiChannelSnapshot | undefined;
+    /** Version continuity failures observed while consuming (gap/backwards/
+     * wire-revision change). A conformant replay must keep this empty. */
+    continuityErrors(): readonly string[];
+}
+/** Wrap a Channel Provider with the consumer-side protocol envelope checks. */
+export declare function createChannelConsumer(provider: ChannelProvider, options?: ChannelConsumerOptions): ChannelConsumer;
+//# sourceMappingURL=consumer.d.ts.map

package/lib/types/adapter/channel/consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AAE9E,MAAM,WAAW,sBAAsB;IACrC;iDAC6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAClE,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,GAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,CAAA;IACtB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACpG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IAC5D,YAAY,IAAI,kBAAkB,GAAG,SAAS,CAAA;IAC9C;0EACsE;IACtE,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,EACzB,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAqEjB"}

package/lib/types/adapter/channel/consumer.js

@@ -0,0 +1,87 @@
+/**
+ * TUI Channel Consumer (P5).
+ *
+ * A Channel Consumer owns the visible terminal side of
+ * `tui.dsh/v1alpha1#Channel`. This module is the conformance-facing client:
+ * it opens a provider, subscribes to snapshots, enforces monotonic versions
+ * and full-snapshot continuity, invokes JSON-value methods, and closes the
+ * channel. It never interprets provider business methods itself.
+ *
+ * Continuity violations are fail-closed by default: the consumer throws
+ * instead of silently retaining a discontinuous snapshot.
+ */
+import { validateTuiChannelOutput, validateTuiChannelSnapshot } from '../spec/index.js';
+/** Wrap a Channel Provider with the consumer-side protocol envelope checks. */
+export function createChannelConsumer(provider, options = {}) {
+    const failClosed = options.failClosed !== false;
+    let last;
+    const continuityErrors = [];
+    function accept(snapshotValue, allowEqual = false) {
+        const snapshot = validateTuiChannelSnapshot(snapshotValue);
+        const errorCountBefore = continuityErrors.length;
+        if (last !== undefined) {
+            if (snapshot.channelId !== last.channelId) {
+                continuityErrors.push(`channel id changed: ${last.channelId} -> ${snapshot.channelId}`);
+            }
+            else if (snapshot.wireRevision !== last.wireRevision) {
+                continuityErrors.push(`wire revision changed: ${last.wireRevision} -> ${snapshot.wireRevision}`);
+            }
+            else if (snapshot.version < last.version) {
+                continuityErrors.push(`version went backwards: ${last.version} -> ${snapshot.version}`);
+            }
+            else if (snapshot.version === last.version && !allowEqual) {
+                continuityErrors.push(`version did not advance: ${last.version} -> ${snapshot.version}`);
+            }
+            else if (snapshot.version > last.version && snapshot.version !== last.version + 1) {
+                continuityErrors.push(`version gap: expected ${last.version + 1}, got ${snapshot.version}`);
+            }
+        }
+        const hasNewError = continuityErrors.length > errorCountBefore;
+        if (hasNewError && failClosed) {
+            throw new Error(`dsh-tui: Channel continuity violation: ${continuityErrors[continuityErrors.length - 1]}`);
+        }
+        // When not fail-closed, keep advancing `last` to the snapshot that was
+        // actually observed so later continuity messages describe the real
+        // sequence rather than a stale pre-violation baseline.
+        if (last === undefined || snapshot.version >= last.version) {
+            last = snapshot;
+        }
+        return snapshot;
+    }
+    return Object.freeze({
+        async open(input) {
+            const snapshot = await provider.open(input);
+            last = undefined;
+            continuityErrors.length = 0;
+            return accept(snapshot);
+        },
+        async subscribe(channelId, afterVersion, listener) {
+            let firstReplay = true;
+            return provider.subscribe(channelId, afterVersion, value => {
+                // Provider semantics are "not earlier than afterVersion": an equal
+                // version echo after `open()` is the first snapshot of a subscription
+                // and must be accepted, while later equal-version duplicates still
+                // violate continuity.
+                listener(accept(value, firstReplay));
+                firstReplay = false;
+            });
+        },
+        async invoke(channelId, method, args) {
+            const output = await provider.invoke(channelId, method, args);
+            const validated = validateTuiChannelOutput('invoke', output);
+            if (validated.snapshot !== undefined)
+                accept(validated.snapshot, true);
+            return validated;
+        },
+        async close(channelId) {
+            const output = await provider.close(channelId);
+            return validateTuiChannelOutput('close', output);
+        },
+        lastSnapshot() {
+            return last;
+        },
+        continuityErrors() {
+            return Object.freeze([...continuityErrors]);
+        },
+    });
+}

package/lib/types/adapter/channel/features.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared Channel Host-Port effect-capability map and derived feature list.
+ *
+ * This is the single source that `HostFacade` shadow policy, the Channel
+ * upstream driver and the Kernel channel slice all consume. Keeping it here
+ * prevents the slice declaration / driver feature list from drifting from the
+ * methods actually exposed by `HostChannelPort`.
+ */
+export declare const CHANNEL_PORT_METHOD_CAPABILITIES: Readonly<Record<string, Readonly<Record<string, string>>>>;
+export declare const CHANNEL_FEATURES: readonly string[];
+export declare const CHANNEL_STANDARD_DECLARATIONS: readonly string[];
+//# sourceMappingURL=features.d.ts.map

package/lib/types/adapter/channel/features.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"features.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/features.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CA6BtG,CAAA;AAEF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAK7C,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAAqB,CAAA"}

package/lib/types/adapter/channel/features.js

@@ -0,0 +1,41 @@
+/**
+ * Shared Channel Host-Port effect-capability map and derived feature list.
+ *
+ * This is the single source that `HostFacade` shadow policy, the Channel
+ * upstream driver and the Kernel channel slice all consume. Keeping it here
+ * prevents the slice declaration / driver feature list from drifting from the
+ * methods actually exposed by `HostChannelPort`.
+ */
+export const CHANNEL_PORT_METHOD_CAPABILITIES = Object.freeze({
+    projection: Object.freeze({
+        ui: 'host.channel.projection.ui',
+        snapshot: 'host.channel.projection.snapshot',
+        subscribe: 'host.channel.projection.subscribe',
+    }),
+    actions: Object.freeze({
+        submit: 'host.channel.actions.submit',
+        steer: 'host.channel.actions.steer',
+        cancel: 'host.channel.actions.cancel',
+        interruptAndDeliver: 'host.channel.actions.interruptAndDeliver',
+        clear: 'host.channel.actions.clear',
+        loadOlder: 'host.channel.actions.loadOlder',
+        notify: 'host.channel.actions.notify',
+    }),
+    state: Object.freeze({
+        snapshot: 'host.channel.state.snapshot',
+    }),
+    plugins: Object.freeze({
+        runExternalCommand: 'host.channel.plugins.run-external-command',
+        openPluginScene: 'host.channel.plugins.open-scene',
+        closePluginScene: 'host.channel.plugins.close-scene',
+        settingsSections: 'host.channel.plugins.settings-sections',
+        subscribeSettingsSections: 'host.channel.plugins.subscribe-settings-sections',
+    }),
+    transcript: Object.freeze({
+        rows: 'host.channel.transcript.rows',
+        traceEvents: 'host.channel.transcript.trace-events',
+    }),
+});
+export const CHANNEL_FEATURES = Object.freeze([...new Set(Object.values(CHANNEL_PORT_METHOD_CAPABILITIES)
+        .flatMap(subPort => Object.values(subPort)))]);
+export const CHANNEL_STANDARD_DECLARATIONS = CHANNEL_FEATURES;

package/lib/types/adapter/channel/host-registry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Host-internal Channel registry for the adapter Kernel.
+ *
+ * The live `Channel` is created by the TUI plugin row after the plugin-host
+ * Kernel may already have been constructed/mounted. Rather than trying to
+ * reorder service mounting, the TUI stores the live Channel under its
+ * composition root in a WeakMap; the Channel driver resolves it lazily when
+ * a Port method is actually called. This keeps the Kernel's composition
+ * independent of the TUI render lifecycle.
+ *
+ * Every entry is normalized to the Cordis composition root before it is used
+ * as a WeakMap key: a child/plugin context passed by a caller must never
+ * create a registry entry that the Kernel (which queries through the root)
+ * cannot resolve.
+ */
+export type TuiChannelRegistration = Readonly<{
+    channel: unknown;
+    token: symbol;
+}>;
+/** Register the live Channel for a composition root.
+ * @returns A token-safe disposer. Registrations have identity independent of
+ * their Channel object: A → B → A and repeated registration of the same
+ * Channel cannot let an older disposer erase or revive the current entry.
+ */
+export declare function registerTuiChannel(ctx: unknown, channel: unknown): () => boolean;
+/** Resolve the live Channel for a composition root. */
+export declare function getRegisteredTuiChannel(ctx: unknown): unknown | undefined;
+/** Return the current registration identity, not only its Channel object. */
+export declare function getTuiChannelRegistration(ctx: unknown): TuiChannelRegistration | undefined;
+/**
+ * Subscribe to live-Channel registration for one composition root.
+ *
+ * The Kernel uses this to re-run a refresh/mount when the TUI plugin creates
+ * and registers its Channel after the plugin-host row has already started.
+ * Returns a disposer; listeners are keyed by normalized composition root.
+ */
+export declare function onTuiChannelRegistered(ctx: unknown, listener: (channel: unknown) => void): () => void;
+/** Subscribe to registration identities for consumers that own capabilities. */
+export declare function onTuiChannelRegistration(ctx: unknown, listener: (registration: TuiChannelRegistration | undefined) => void): () => void;
+//# sourceMappingURL=host-registry.d.ts.map

package/lib/types/adapter/channel/host-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-registry.d.ts","sourceRoot":"","sources":["../../../../src/adapter/channel/host-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAgBlF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,OAAO,CAehF;AAyBD,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAEzE;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,GAAG,SAAS,CAG1F;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GACnC,MAAM,IAAI,CAUZ;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,CAAC,YAAY,EAAE,sBAAsB,GAAG,SAAS,KAAK,IAAI,GACnE,MAAM,IAAI,CAUZ"}