@deepseek-harness-tui/dsh-tui 0.14.1 → 0.16.0

package/lib/types/update.js

@@ -4,18 +4,24 @@ import { appendFileSync, chmodSync, copyFileSync, existsSync, lstatSync, mkdirSy
 import { homedir } from 'node:os';
 import { dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { gte, gt, lt, valid } from 'semver';
+// Per-function imports: this file loads before the first frame.
+import gt from 'semver/functions/gt.js';
+import gte from 'semver/functions/gte.js';
+import lt from 'semver/functions/lt.js';
+import valid from 'semver/functions/valid.js';
 import { shellQuote } from './utils/shellQuote.js';
 import { DATA_DIR } from './utils/paths.js';
 import { stripResumeArgs } from './sessionHistory.js';
-import { KERNEL_SWITCH_HANDOFF_ENV, isKernelId, kernelDisplayName } from './kernelPrefs.js';
+import { HOST_ENTRY_PATH_ENV, KERNEL_SWITCH_HANDOFF_ENV, RESUME_BACKEND_ENV, RESUME_RETRY_ENV, hostEntryDisabled, parseBackendId } from './kernelPrefs.js';
 import { classifyReplacementOutcome, formatHandoffNotice, handoffEventTag, writeHandoffStage } from './handoffEvents.js';
 import { HANDOFF_ACK_FD_ENV, HANDOFF_ATTEMPT_ENV, HANDOFF_SCREEN_ENV, parseHandoffAckLine } from './handoffAck.js';
 import { DISABLE_KITTY_KEYBOARD, DISABLE_MODIFY_OTHER_KEYS, DISABLE_WIN32_INPUT_MODE } from './ink/termio/csi.js';
 import { DBP, DFE, DISABLE_MOUSE_TRACKING, EXIT_ALT_SCREEN, SHOW_CURSOR } from './ink/termio/dec.js';
+import { detachHandoffStdin } from './ink/stdin-handoff.js';
 // Re-exported for scripts/verify-update.mjs and the bin launcher, which reads
 // the compiled copy at lib/types/utils/shellQuote.js.
 export { shellQuote };
+export { detachHandoffStdin };
 const PACKAGE_NAME = '@deepseek-harness-tui/dsh-tui';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
 const GITHUB_REPO = 'ccch1mneyyy/dsh-TUI';
@@ -39,6 +45,12 @@ const UPDATED_FROM_ENV = 'DSH_TUI_UPDATED_FROM';
  * (ordinary launches stay silent, so the file is restart-only evidence).
  */
 const RESTART_CHILD_ENV = 'DSH_TUI_RESTART_CHILD';
+/**
+ * env marker on every replacement (/restart, /update, kernel switch): it is
+ * started with the original app arguments, so a command-line prompt in them
+ * was already sent by the first process and must not be sent again.
+ */
+export const LAUNCH_PROMPT_SENT_ENV = 'DSH_TUI_LAUNCH_PROMPT_SENT';
 /**
  * Field-diagnosis log for the /restart terminal handoff, appended by BOTH
  * processes: the exiting TUI logs the funnel path, the spawned replacement
@@ -118,14 +130,19 @@ export function readLastRunRecord(file = LAST_RUN_FILE) {
         if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
             return undefined;
         const record = parsed;
-        if (!isKernelId(record.backendId))
+        // The syntax gate only: this module is also loaded by the launcher's retry
+        // path, which must not pull the registry (and cannot, without compiled
+        // modules). A record naming an uninstalled plugin reads back fine — the boot
+        // then falls back to dsh with a warning, like any unknown value (P0 D1).
+        const backendId = parseBackendId(record.backendId);
+        if (backendId === undefined)
             return undefined;
         if (typeof record.sessionId !== 'string' || typeof record.cwd !== 'string' || typeof record.attemptId !== 'string')
             return undefined;
         if (typeof record.updatedAt !== 'number' || !Number.isFinite(record.updatedAt))
             return undefined;
         return {
-            backendId: record.backendId,
+            backendId,
             sessionId: record.sessionId,
             cwd: record.cwd,
             attemptId: record.attemptId,
@@ -902,6 +919,9 @@ export async function resolveTuiUpdateTarget() {
  * or blocks the interactive TUI.
  */
 export async function checkForTuiUpdate() {
+    // Callers start this during the first render; the first `fetch()` loads
+    // undici synchronously, so yield first and let that cost land after the frame.
+    await new Promise(resolve => setImmediate(resolve));
     const target = await resolveTuiUpdateTarget();
     return target.kind === 'update'
         ? {
@@ -1001,7 +1021,11 @@ function allowBuildsKeyLine(key) {
  * ERR_PNPM_IGNORED_BUILDS diagnostic stays the visible fallback.
  */
 export function ensureProfileAllowBuilds(profile) {
-    const yamlPath = profileWorkspaceYamlPath(profile);
+    return ensureWorkspaceAllowBuilds(profileWorkspaceYamlPath(profile));
+}
+/** Path-based core of {@link ensureProfileAllowBuilds} for callers that hold
+ *  the profile directory itself (the Claude SDK installer's heal pass). */
+export function ensureWorkspaceAllowBuilds(yamlPath) {
     try {
         if (!existsSafe(dirname(yamlPath)))
             return undefined;
@@ -1174,6 +1198,51 @@ export function ensureProfileReleaseAgeExclude(profile, version, alsoExempt) {
         return undefined;
     }
 }
+/**
+ * pnpm resolves its content-addressable store from the environment when no
+ * explicit setting exists: a pnpm run under a redirected \u0060XDG_DATA_HOME\u0060
+ * (sandbox, relay, container) silently records THAT location in the
+ * profile's \u0060node_modules/.modules.yaml\u0060, and every later pnpm run in the
+ * profile — dsh's own updates, plugin installs, the Claude SDK wizard —
+ * dies with ERR_PNPM_UNEXPECTED_STORE until node_modules is rebuilt by
+ * hand. Pin \u0060storeDir\u0060 in the profile's pnpm-workspace.yaml so all of them
+ * resolve the same store whatever the environment says. The value is
+ * relative on purpose: pnpm resolves it against the workspace file\u0027s
+ * directory, landing on \u0060<dsh home>/.pnpm-store\u0060 beside the profiles root
+ * for every user and surviving a relocated \u0060DSH_HOME\u0060. Same best-effort,
+ * idempotent pattern as {@link ensureProfileAllowBuilds}: an existing
+ * top-level \u0060storeDir:\u0060 is never overwritten (an explicit user decision
+ * wins), a missing file is created, and any failure resolves to undefined —
+ * pnpm's own diagnostic stays the visible fallback, and the installer's
+ * store-mismatch self-heal catches what a failed pin leaves behind.
+ */
+export function ensureWorkspaceStoreDir(yamlPath) {
+    try {
+        if (!existsSafe(dirname(yamlPath)))
+            return undefined;
+        let text = '';
+        try {
+            text = readFileSync(yamlPath, 'utf8');
+        }
+        catch {
+            // Missing file — start from an empty document; writeFileSync creates it.
+        }
+        const lines = text.split(/\r?\n/u);
+        for (const line of lines) {
+            if (line !== '' && line === line.trimStart() && /^storeDir:/u.test(line)) {
+                return { changed: false };
+            }
+        }
+        if (lines.length > 0 && lines[lines.length - 1] !== '')
+            lines.push('');
+        lines.push('storeDir: ../../.pnpm-store');
+        writeFileSync(yamlPath, `${lines.join('\n')}\n`);
+        return { changed: true };
+    }
+    catch {
+        return undefined;
+    }
+}
 function existsSafe(path) {
     try {
         statSync(path);
@@ -1681,7 +1750,9 @@ export async function updateTui(profile, targetVersion) {
  * @param kernel - The kernel this process runs (TuiRestartOptions.kernel).
  * @returns Exit codes for the update run and the replacement process.
  */
-export async function updateTuiAndRestart(sessionId, profile, targetVersion, kernel) {
+export async function updateTuiAndRestart(sessionId, profile, targetVersion, kernel, 
+/** The standalone entry's supervision hooks (TuiRestartOptions.onSpawn / onTerminationSignal). */
+supervision = {}) {
     const outcome = await updateTui(profile, targetVersion);
     const { updatedFrom } = outcome;
     if (outcome.code !== 0)
@@ -1697,6 +1768,7 @@ export async function updateTuiAndRestart(sessionId, profile, targetVersion, ker
         env: { [UPDATED_FROM_ENV]: updatedFrom },
         kind: 'update',
         ...(kernel === undefined ? {} : { kernel }),
+        ...supervision,
     });
     return { updateCode: 0, restartCode };
 }
@@ -1762,33 +1834,6 @@ export async function cliUpdate(profile) {
     }
     return outcome.code;
 }
-/**
- * Release the shared console for the replacement without resetting it.
- *
- * A pty's termios is per-DEVICE: destroying this stream would write this
- * process's saved cooked/ECHO mode back over the replacement's raw mode
- * (libuv restores orig_termios on tty close; verified on Node 24 — mouse
- * reports then echo as `^[[<…M` and keys wait for a newline). Detaching —
- * no readers, paused, unref'd — keeps the mode untouched.
- *
- * Two deliberate trade-offs vs the old destroy():
- * - destroy() doubled as a permanent gate ("a destroyed stream can never be
- *   resumed"). Readers removed + paused already keep this process out of the
- *   console's key path (#284/#307), and after the handoff only the
- *   child-exit listener remains here — nothing re-attaches a reader.
- * - On exit Node still writes the saved cooked mode back once (atexit
- *   uv_tty_reset_mode). Fine in the normal order — this process outlives the
- *   replacement, and the shell wants cooked back anyway; it only bites if
- *   this process dies while the replacement is still running.
- *
- * @param stdin - Console stream to detach; injectable for the regression.
- */
-export function detachHandoffStdin(stdin = process.stdin) {
-    stdin.removeAllListeners('readable');
-    stdin.removeAllListeners('data');
-    stdin.pause();
-    stdin.unref();
-}
 /**
  * The replacement's env, pure: the resume marker, the /restart child stamp,
  * the caller's extra markers and the kernel-switch overrides. Exported for
@@ -1803,8 +1848,13 @@ export function restartChildEnv(parentEnv, sessionId, kind, options) {
         // Marks the replacement so its own boot logs to restart.log without
         // noisy logging on every ordinary launch (/restart only).
         ...(kind === 'restart' ? { [RESTART_CHILD_ENV]: '1' } : {}),
+        [LAUNCH_PROMPT_SENT_ENV]: '1',
         ...options.env,
     };
+    // The Config schema preserves '', so an absent session must be represented
+    // by removing the marker, including one inherited from the previous launch.
+    if (sessionId === '')
+        delete childEnv.DSH_TUI_RESUME_SESSION;
     // A stale handoff override never leaks into a plain replacement: the var is
     // one-shot (consumed at this process's own boot), and a child that is NOT
     // switching kernels keeps this process's kernel by config/env/memory as
@@ -1816,6 +1866,16 @@ export function restartChildEnv(parentEnv, sessionId, kind, options) {
     delete childEnv[HANDOFF_SCREEN_ENV];
     delete childEnv[HANDOFF_ACK_FD_ENV];
     delete childEnv[HANDOFF_ATTEMPT_ENV];
+    // A derived resume target's provenance is never inherited: whatever survives
+    // here was built by THIS process, and on a kernel switch even the target itself
+    // goes (below). Keeping a stale mark would make the replacement revoke a target
+    // nobody derived (see resolveResumeTarget in kernelPrefs.ts).
+    delete childEnv[RESUME_BACKEND_ENV];
+    // Same for the safe-mode retry marker: "this boot is a retry" describes the
+    // process the launcher spawned, not the replacement it spawns now. The boot
+    // consumes it on read anyway — this keeps a replacement honest even if one is
+    // ever built from an env that still carries it.
+    delete childEnv[RESUME_RETRY_ENV];
     if (options.backend === undefined && options.kernel !== undefined)
         childEnv[KERNEL_SWITCH_HANDOFF_ENV] = options.kernel;
     if (options.backend !== undefined) {
@@ -1832,15 +1892,33 @@ export function restartChildEnv(parentEnv, sessionId, kind, options) {
     }
     return childEnv;
 }
+/**
+ * The replacement's argv after `process.execPath`, pure: the same script and
+ * arguments again, except that a replacement started outside the entry goes
+ * to `hostEntry` with the app arguments (the entry hosts every kernel).
+ */
+export function restartArgv(input) {
+    const strip = (args) => input.switching || input.fresh === true ? stripResumeArgs(args) : [...args];
+    const script = input.argv[1];
+    if (input.hostEntry !== undefined && script !== input.hostEntry) {
+        // The app arguments: everything after dsh's own `--`.
+        const separator = input.argv.indexOf('--', 2);
+        const appArgs = separator === -1 ? [] : input.argv.slice(separator + 1);
+        return [...input.execArgv, input.hostEntry, ...strip(appArgs)];
+    }
+    return [...input.execArgv, ...strip(input.argv.slice(1))];
+}
 export async function restartTui(sessionId, options = {}) {
     const kind = options.kind ?? 'restart';
     const tag = options.backend !== undefined ? 'backend-switch' : kind === 'update' ? 'update-restart' : 'restart';
-    // A kernel switch must not hand the replacement THIS kernel's resume
-    // flags: an inherited `--resume <id>` in argv would send the new kernel
-    // looking for a session that belongs to the kernel it just left — the
-    // same reason DSH_TUI_RESUME_SESSION is deleted below.
-    const appArgs = process.argv.slice(1);
-    const argv = [...process.execArgv, ...(options.backend === undefined ? appArgs : stripResumeArgs(appArgs))];
+    const hostEntry = process.env[HOST_ENTRY_PATH_ENV];
+    const argv = restartArgv({
+        execArgv: process.execArgv,
+        argv: process.argv,
+        switching: options.backend !== undefined,
+        fresh: sessionId === '',
+        hostEntry: hostEntry === undefined || hostEntry === '' || hostEntryDisabled() ? undefined : hostEntry,
+    });
     logRestartEvent(`${tag}: spawning replacement`, {
         node: process.execPath,
         argv,
@@ -1866,7 +1944,7 @@ export async function restartTui(sessionId, options = {}) {
     // "Starting X…" goes out before the spawn, waiting for the write callback
     // so it lands before the replacement draws anything.
     if (options.backend !== undefined) {
-        await writeHandoffStage(process.stdout, formatHandoffNotice('stage-start', { name: kernelDisplayName(options.backend), color: process.stdout.isTTY === true }) + '\n');
+        await writeHandoffStage(process.stdout, formatHandoffNotice('stage-start', { name: options.backendName ?? options.backend, color: process.stdout.isTTY === true }) + '\n');
         logRestartEvent(handoffEventTag('stage-start'), { backend: options.backend, ...(attemptId === undefined ? {} : { attemptId }) });
     }
     return new Promise(resolve => {
@@ -1878,6 +1956,9 @@ export async function restartTui(sessionId, options = {}) {
             childEnv[HANDOFF_ATTEMPT_ENV] = attemptId;
             logRestartEvent('handoff: alt-screen bracket held for the replacement', { attemptId });
         }
+        // Reassert after root disposal: even a late drain must not restart the
+        // parent's native stdin read before the replacement probes the terminal.
+        detachHandoffStdin();
         const child = spawn(process.execPath, argv, {
             env: childEnv,
             // stdin/stdout stay inherited so the replacement owns the console the
@@ -1930,6 +2011,7 @@ export async function restartTui(sessionId, options = {}) {
             ackWatch.unref();
         }
         logRestartEvent(`${tag}: replacement spawned`, { childPid: child.pid, ...(options.backend === undefined ? {} : { backend: options.backend }) });
+        options.onSpawn?.(child);
         // Handoff watchdog (field evidence 2026-08-24: restarted TUI mounts but
         // takes no input). Two jobs, both diagnosis-grade:
         // 1. SAMPLE this process's stdin state every second — if anything
@@ -1995,7 +2077,7 @@ export async function restartTui(sessionId, options = {}) {
                 // not a crash.
                 logRestartEvent(handoffEventTag('failed'), { reason: 'spawn-error', message: error.message });
                 writeHandoffNotice(formatHandoffNotice('failed', {
-                    name: kernelDisplayName(options.backend),
+                    name: options.backendName ?? options.backend,
                     reason: 'spawn-error',
                     safeHint: true,
                     color: process.stderr.isTTY === true,
@@ -2015,6 +2097,12 @@ export async function restartTui(sessionId, options = {}) {
                 signal: signal ?? null,
                 elapsedMs,
             });
+            // A replacement that took the screen over and died by a signal: the hook
+            // may end this process by that signal. Before a handoff's first frame this
+            // process still holds the screen, so the failure path below restores it.
+            if (signal !== null && options.onTerminationSignal !== undefined && (!handoff || ackReadyAt !== undefined)) {
+                options.onTerminationSignal(signal);
+            }
             if (options.backend !== undefined) {
                 // Kernel switch outcome: success is quiet (restart.log only), a
                 // replacement that never came up is a yellow failure with the session
@@ -2037,7 +2125,7 @@ export async function restartTui(sessionId, options = {}) {
                         restoreHandoffScreen();
                     const suffix = childStderr.trim() === '' ? '' : `\n${childStderr.trimEnd()}`;
                     writeHandoffNotice(formatHandoffNotice('failed', {
-                        name: kernelDisplayName(options.backend),
+                        name: options.backendName ?? options.backend,
                         reason: outcome.reason,
                         safeHint: true,
                         color: process.stderr.isTTY === true,
@@ -2049,7 +2137,7 @@ export async function restartTui(sessionId, options = {}) {
                     if (handoff && signal !== null)
                         restoreHandoffScreen();
                     writeHandoffNotice('\n' + formatHandoffNotice('crashed', {
-                        name: kernelDisplayName(options.backend),
+                        name: options.backendName ?? options.backend,
                         code: outcome.code,
                         safeHint: true,
                         color: process.stderr.isTTY === true,

package/lib/types/utils/bmp.d.ts

@@ -7,6 +7,13 @@
  * bottom-up or top-down. Anything else returns null and the caller keeps its
  * "format unsupported" path.
  */
+/**
+ * Whether the bytes open like a bitmap: a `BM` file, or a headerless DIB —
+ * the shape an X11 or Windows clipboard owner hands over. Structural only;
+ * {@link bmpToPng} still does the real validation, so a false positive costs
+ * one refused conversion and nothing else.
+ */
+export declare function looksLikeBitmap(bytes: Uint8Array): boolean;
 /**
  * Convert BMP bytes (a `BM` file, or a headerless DIB) to PNG.
  * @param bmp - Raw clipboard bytes.

package/lib/types/utils/bmp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bmp.d.ts","sourceRoot":"","sources":["../../../src/utils/bmp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8DH;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4FlE"}
+{"version":3,"file":"bmp.d.ts","sourceRoot":"","sources":["../../../src/utils/bmp.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmEH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4FlE"}

package/lib/types/utils/bmp.js

@@ -51,6 +51,33 @@ async function encodePng(width, height, channels, pixels) {
         pngChunk('IEND', Buffer.alloc(0)),
     ]);
 }
+/** DIB header sizes a bitmap can carry: the OS/2 core header (12), the
+ *  BITMAPINFOHEADER (40), its three V2/V3 extensions (52/56/64) and the V4/V5
+ *  headers (108/124). */
+const DIB_HEADER_SIZES = new Set([12, 40, 52, 56, 64, 108, 124]);
+/**
+ * Whether the bytes open like a bitmap: a `BM` file, or a headerless DIB —
+ * the shape an X11 or Windows clipboard owner hands over. Structural only;
+ * {@link bmpToPng} still does the real validation, so a false positive costs
+ * one refused conversion and nothing else.
+ */
+export function looksLikeBitmap(bytes) {
+    if (bytes.length >= 2 && bytes[0] === 0x42 && bytes[1] === 0x4d)
+        return true;
+    if (bytes.length < 16)
+        return false;
+    const headerSize = (bytes[0] | (bytes[1] << 8) | (bytes[2] << 16) | (bytes[3] << 24)) >>> 0;
+    if (!DIB_HEADER_SIZES.has(headerSize))
+        return false;
+    // The OS/2 core header is 12 bytes and puts planes/depth earlier than the
+    // Windows headers do. Planes is 1 in every real bitmap, and the depth must
+    // be one BMP defines.
+    const windowsHeader = headerSize !== 12;
+    const planes = windowsHeader ? bytes[12] | (bytes[13] << 8) : bytes[8] | (bytes[9] << 8);
+    const bpp = windowsHeader ? bytes[14] | (bytes[15] << 8) : bytes[10] | (bytes[11] << 8);
+    return planes === 1
+        && (bpp === 1 || bpp === 4 || bpp === 8 || bpp === 16 || bpp === 24 || bpp === 32);
+}
 /**
  * Convert BMP bytes (a `BM` file, or a headerless DIB) to PNG.
  * @param bmp - Raw clipboard bytes.

package/lib/types/utils/bootTrace.d.ts

@@ -0,0 +1,2 @@
+export declare function markBoot(mark: string): void;
+//# sourceMappingURL=bootTrace.d.ts.map

package/lib/types/utils/bootTrace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootTrace.d.ts","sourceRoot":"","sources":["../../../src/utils/bootTrace.ts"],"names":[],"mappings":"AAUA,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ3C"}

package/lib/types/utils/bootTrace.js

@@ -0,0 +1,20 @@
+/**
+ * Opt-in boot timeline for startup measurements. With
+ * `DSH_TUI_BOOT_TRACE=<file>` each mark appends one JSON line to that file:
+ * `{"mark","ms","at","pid"}`, where `ms` counts from this process's start and
+ * `at` is the wall clock (for lining up with the launcher). Otherwise it does
+ * nothing. Never writes to stdout/stderr.
+ */
+import { appendFileSync } from 'node:fs';
+import { performance } from 'node:perf_hooks';
+export function markBoot(mark) {
+    const file = process.env.DSH_TUI_BOOT_TRACE;
+    if (file === undefined || file === '')
+        return;
+    try {
+        appendFileSync(file, `${JSON.stringify({ mark, ms: Math.round(performance.now()), at: Date.now(), pid: process.pid })}\n`);
+    }
+    catch {
+        // A measurement aid must never affect the boot.
+    }
+}

package/lib/types/utils/clipboard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clipboard.d.ts","sourceRoot":"","sources":["../../../src/utils/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAeH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAA;AAE5F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA6BtD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAIvE;AAWD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAYtE;AAiDD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C;AAsfD;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAStD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAcvE"}
+{"version":3,"file":"clipboard.d.ts","sourceRoot":"","sources":["../../../src/utils/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAeH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,gBAAgB,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAA;AAE5F;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA6BtD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAIvE;AAWD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAYtE;AAyDD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAS9C;AAufD;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAStD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAcvE"}

package/lib/types/utils/clipboard.js

@@ -148,9 +148,16 @@ const IMAGE_EXTENSIONS = {
     'image/gif': '.gif',
     'image/webp': '.webp',
     'image/bmp': '.bmp',
+    'image/x-bmp': '.bmp',
+    'image/x-ms-bmp': '.bmp',
+    'image/vnd.microsoft.bitmap': '.bmp',
     'image/tiff': '.tiff',
     'image/svg+xml': '.svg',
 };
+/** Every MIME spelling a bitmap copy arrives under — Windows, WSLg and X11
+ *  owners disagree on it, and all of them go to the dependency-free
+ *  converter, so the paste does not depend on which spelling won. */
+const BMP_MEDIA_TYPES = /^image\/(?:x-ms-|x-|vnd\.microsoft\.)?bmp$/iu;
 // Per-process private directory for exported clipboard images, created
 // lazily on the first image paste. mkdtemp guarantees a fresh,
 // unpredictably-named directory; mode 0700 keeps other local users out of
@@ -269,9 +276,10 @@ async function captureLinuxImage(tool, mime) {
     const result = await spawnForBuffer(tool, args);
     if (result.code !== 0 || result.stdout.length === 0)
         return null;
-    // A Windows bitmap copy (WSLg) arrives as image/bmp, which the attachment
-    // profile rejects: convert to PNG, keeping the BMP bytes when it cannot be.
-    const png = /^image\/(?:x-ms-)?bmp$/iu.test(mime) ? await bmpToPng(result.stdout) : null;
+    // A bitmap copy (a Windows/WSLg owner, or an X11 one) arrives under one of
+    // the bitmap spellings, none of which the attachment profile accepts:
+    // convert to PNG, keeping the bitmap bytes when the conversion cannot.
+    const png = BMP_MEDIA_TYPES.test(mime) ? await bmpToPng(result.stdout) : null;
     return writeImageExport(png === null ? mime : 'image/png', png ?? result.stdout);
 }
 /**

package/lib/types/utils/credentials.d.ts

@@ -1,13 +1,25 @@
 /** The DSH home that owns the credential store, following the launcher's rule. */
 export declare function dshHomeDir(): string;
 /**
- * Whether the DSH credential store declares a reference by this name.
+ * The credential documents a read may consult, most authoritative first: the
+ * active home's store, then the default `~/.dsh` store.
+ *
+ * A `DSH_HOME` override moves the harness home, but the codex bridge and
+ * `/doctor` are dsh-tui's own surfaces: a key the user stored at the location
+ * both READMEs name (`~/.dsh/.credentials.yaml`) must keep working instead of
+ * reporting "missing" for a key that is sitting right there.
+ * @param home - DSH home override; defaults to {@link dshHomeDir}.
+ * @returns Candidate file paths, most authoritative first.
+ */
+export declare function credentialStoreFiles(home?: string): readonly string[];
+/**
+ * Whether any credential store declares a reference by this name.
  *
  * Only the top-level `refs:` block is inspected — the bare name also appears in
  * grants and payloads, where a match would be a false positive.
  * @param name - Reference name to look for (for example `DEEPSEEK_API_KEY`).
  * @param home - DSH home override; defaults to {@link dshHomeDir}.
- * @returns True when a `refs` entry with that name exists.
+ * @returns True when a `refs` entry with that name exists in any store.
  */
 export declare function credentialRefDeclared(name: string, home?: string): boolean;
 //# sourceMappingURL=credentials.d.ts.map

package/lib/types/utils/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/utils/credentials.ts"],"names":[],"mappings":"AAgBA,kFAAkF;AAClF,wBAAgB,UAAU,IAAI,MAAM,CAMnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAqB,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/utils/credentials.ts"],"names":[],"mappings":"AAmBA,kFAAkF;AAClF,wBAAgB,UAAU,IAAI,MAAM,CAMnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,MAAqB,GAAG,SAAS,MAAM,EAAE,CAInF;AAeD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAqB,GAAG,OAAO,CAExF"}

package/lib/types/utils/credentials.js

@@ -4,10 +4,13 @@
  * The store is a small YAML document at `$DSH_HOME/.credentials.yaml` whose
  * top-level `refs:` block maps reference names (for example `DEEPSEEK_API_KEY`)
  * to stored secrets. dsh resolves those refs into a session at launch, so an
- * environment-only check reports "missing" for a key that works. This module
- * only ever answers "is a ref declared": the value is never read, formatted, or
- * logged. The launcher keeps a mirror of this check in `bin/dsh-tui.js` (it is
- * dependency-free and cannot import `lib/`); the two must not diverge.
+ * environment-only check reports "missing" for a key that works. A read also
+ * consults the default `~/.dsh` store ({@link credentialStoreFiles}), so a
+ * `DSH_HOME` override does not orphan keys stored at the documented location.
+ * This module only ever answers "is a ref declared": the value is never read,
+ * formatted, or logged. The launcher keeps a mirror of this check in
+ * `bin/dsh-tui.js` (it is dependency-free and cannot import `lib/`); the two
+ * must not diverge.
  * @module dsh-tui/utils/credentials
  */
 import { readFileSync } from 'node:fs';
@@ -22,17 +25,25 @@ export function dshHomeDir() {
     return process.env.DSH_HOME || join(homedir(), '.dsh');
 }
 /**
- * Whether the DSH credential store declares a reference by this name.
+ * The credential documents a read may consult, most authoritative first: the
+ * active home's store, then the default `~/.dsh` store.
  *
- * Only the top-level `refs:` block is inspected — the bare name also appears in
- * grants and payloads, where a match would be a false positive.
- * @param name - Reference name to look for (for example `DEEPSEEK_API_KEY`).
+ * A `DSH_HOME` override moves the harness home, but the codex bridge and
+ * `/doctor` are dsh-tui's own surfaces: a key the user stored at the location
+ * both READMEs name (`~/.dsh/.credentials.yaml`) must keep working instead of
+ * reporting "missing" for a key that is sitting right there.
  * @param home - DSH home override; defaults to {@link dshHomeDir}.
- * @returns True when a `refs` entry with that name exists.
+ * @returns Candidate file paths, most authoritative first.
  */
-export function credentialRefDeclared(name, home = dshHomeDir()) {
+export function credentialStoreFiles(home = dshHomeDir()) {
+    const active = join(home, '.credentials.yaml');
+    const fallback = join(homedir(), '.dsh', '.credentials.yaml');
+    return active === fallback ? [active] : [active, fallback];
+}
+/** Whether one document declares `name` in its top-level `refs:` block. */
+function refDeclaredIn(file, name) {
     try {
-        const text = readFileSync(join(home, '.credentials.yaml'), 'utf8');
+        const text = readFileSync(file, 'utf8');
         const block = /^refs:[ \t]*\r?\n((?:[ \t]+\S.*(?:\r?\n|$))*)/mu.exec(text);
         if (block === null)
             return false;
@@ -43,3 +54,15 @@ export function credentialRefDeclared(name, home = dshHomeDir()) {
         return false;
     }
 }
+/**
+ * Whether any credential store declares a reference by this name.
+ *
+ * Only the top-level `refs:` block is inspected — the bare name also appears in
+ * grants and payloads, where a match would be a false positive.
+ * @param name - Reference name to look for (for example `DEEPSEEK_API_KEY`).
+ * @param home - DSH home override; defaults to {@link dshHomeDir}.
+ * @returns True when a `refs` entry with that name exists in any store.
+ */
+export function credentialRefDeclared(name, home = dshHomeDir()) {
+    return credentialStoreFiles(home).some(file => refDeclaredIn(file, name));
+}

package/lib/types/utils/imageResize.d.ts

@@ -1,23 +1,7 @@
-export interface ImageSizeProbe {
-    readonly width: number;
-    readonly height: number;
-}
-/**
- * The image media type the encoded bytes actually are, from the magic
- * bytes alone (the same signatures {@link probeImageSize} dispatches on):
- * PNG, JPEG, WebP (RIFF/WEBP) or GIF; anything else is undefined and the
- * caller keeps its own label (those bytes take the decode-or-refuse path
- * anyway). Used to keep a renamed file from travelling under a label its
- * content contradicts.
- */
-export declare function sniffImageMediaType(bytes: Uint8Array): 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif' | undefined;
-/**
- * Measure intrinsic pixel dimensions from the encoded bytes alone — no
- * decode, no dependencies. Recognizes PNG / JPEG / WebP (VP8X, VP8,
- * VP8L) / GIF; anything else returns null, which callers MUST treat as
- * "unknown, force a real decode" — never as "small enough".
- */
-export declare function probeImageSize(bytes: Uint8Array): ImageSizeProbe | null;
+import { probeImageSize, sniffImageMediaType } from '../backends/shared/image-size.js';
+import type { ImageSizeProbe } from '../backends/shared/image-size.js';
+export { probeImageSize, sniffImageMediaType };
+export type { ImageSizeProbe };
 /** The admission limits that matter for resampling decisions. */
 export interface ResizeLimits {
     /** Maximum intrinsic width AND height, per side, in pixels. */
@@ -65,6 +49,12 @@ export type AdaptOutcome = {
  * short-circuits the common case — bytes it proves to be inside the caps in an
  * accepted format are returned untouched, with no encoder loaded.
  *
+ * A bitmap paste is converted before any of that: BMP is a format the byte
+ * probe cannot measure and libvips cannot decode at all, so a WeChat or X11
+ * clipboard copy used to be refused as "unsupported image format" however
+ * valid it was. {@link bmpToPng} is dependency-free, so the conversion also
+ * covers deployments without sharp.
+ *
  * Aspect ratio is preserved by {@link downscaleTarget}. An animated source is
  * REFUSED whenever this gate would have to touch its bytes: re-encoding a
  * multi-page image here cannot promise frames, delays and loop survive, and

package/lib/types/utils/imageResize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imageResize.d.ts","sourceRoot":"","sources":["../../../src/utils/imageResize.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAiFD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAO1H;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAevE;AAED,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,wCAAwC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAIzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,cAAc,CAW1F;AAqCD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B,GACC;IACA;;;qDAGiD;IACjD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,sBAAsB,CAAA;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,YAAY,EACpB,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,YAAY,CAAC,CAuDvB"}
+{"version":3,"file":"imageResize.d.ts","sourceRoot":"","sources":["../../../src/utils/imageResize.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AAGtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,CAAA;AAC9C,YAAY,EAAE,cAAc,EAAE,CAAA;AAE9B,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,wCAAwC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAIzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,GAAG,cAAc,CAW1F;AAqCD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B,GACC;IACA;;;qDAGiD;IACjD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,sBAAsB,CAAA;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAcH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,YAAY,EACpB,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,OAAO,CAAC,YAAY,CAAC,CA8FvB"}