@deepseek-harness-tui/dsh-tui 0.15.0 → 0.16.0

package/lib/types/dsh-adapter/plugins-info.js

@@ -39,10 +39,10 @@ import { t } from '../i18n.js';
 import { loadSpecData } from '../adapter/standard/registry.js';
 import { createContractIndex, validatePlugin, negotiate } from '../adapter/standard/admission.js';
 import { cleanScalarText } from './sanitize.js';
-import { isCompositionOwned } from './plugin-declaration.js';
+import { isCompositionOwned, pluginDeclarationIn } from './plugin-declaration.js';
 import { extraBundles, localizedPluginText } from './plugin-manager.js';
 import { PLUGIN_STORAGE_DIR } from './plugin-storage.js';
-import { EFFECT_LEDGER_FILE } from './effect-ledger.js';
+import { EFFECT_LEDGER_NAME } from './effect-ledger.js';
 /** How many plugins the matrix shows before an overflow note. */
 export const PLUGINS_MATRIX_MAX_ROWS = 20;
 /** How many ledger records the tail section shows. */
@@ -100,9 +100,15 @@ function redactText(value) {
         return redacted === match ? match.replace(USERINFO_AT_START, '$1') : redacted;
     });
 }
-/** One report cell: credentials redacted first, then sanitized, then capped —
- *  truncation comes last, or a cut URL keeps the head of its own secret. */
-const cell = (value) => cleanScalarText(redactText(String(value ?? '')), LINE_CELLS);
+/**
+ * One report cell: credentials redacted first, then sanitized, then capped —
+ * truncation comes last, or a cut URL keeps the head of its own secret.
+ *
+ * Exported for the install flow (C-4): pnpm's output and the service's error
+ * text are foreign input reaching the same transcript, and one renderer means
+ * the two surfaces cannot disagree about what a cell is.
+ */
+export const cell = (value) => cleanScalarText(redactText(String(value ?? '')), LINE_CELLS);
 /** One URL field as a report cell: credentials stripped, then capped. */
 const urlCell = (value) => cell(redactUrl(value));
 /** Parse the ledger file tolerantly (skip corrupt lines, never throw). */
@@ -132,10 +138,10 @@ function readLedgerRecords(file) {
 /** The plugin set for the matrix: grants-file keys ∪ ledger pluginIds ∪
  *  storage namespaces ('host'/'undeclared' ledger identities are not
  *  plugins and are excluded). */
-function footprintPlugins(deps, dataDir, ledgerFile, storageDir) {
+export function pluginFootprints(paths) {
     const found = new Set();
     try {
-        const raw = JSON.parse(readFileSync(join(dataDir, 'extension-grants.json'), 'utf8'));
+        const raw = JSON.parse(readFileSync(join(paths.dataDir, 'extension-grants.json'), 'utf8'));
         if (raw !== null && typeof raw === 'object') {
             const table = raw;
             for (const section of [table.grants, table.denies]) {
@@ -150,13 +156,13 @@ function footprintPlugins(deps, dataDir, ledgerFile, storageDir) {
         // Missing/corrupt grants file: the GrantStore already answers deny;
         // the matrix simply has no rows from this source.
     }
-    for (const record of readLedgerRecords(ledgerFile)) {
+    for (const record of readLedgerRecords(paths.ledgerFile)) {
         if (typeof record.pluginId === 'string' && record.pluginId !== '' && record.pluginId !== 'host' && record.pluginId !== 'undeclared') {
             found.add(record.pluginId);
         }
     }
     try {
-        for (const entry of readdirSync(storageDir)) {
+        for (const entry of readdirSync(paths.storageDir)) {
             if (!entry.endsWith('.json'))
                 continue;
             const namespace = decodeURIComponent(entry.slice(0, -'.json'.length));
@@ -167,9 +173,29 @@ function footprintPlugins(deps, dataDir, ledgerFile, storageDir) {
     catch {
         // No storage directory yet: no rows from this source.
     }
-    void deps;
     return [...found].sort();
 }
+/**
+ * The three footprint sources, resolved the way the diagnostics resolve them
+ * (test overrides first, else the packaged locations under `~/.dsh-tui`).
+ */
+export function pluginFootprintPaths(overrides = {}) {
+    const dataDir = overrides.dataDir ?? DATA_DIR;
+    return {
+        dataDir,
+        ledgerFile: overrides.ledgerFile ?? join(dataDir, EFFECT_LEDGER_NAME),
+        storageDir: overrides.storageDir ?? join(dataDir, PLUGIN_STORAGE_DIR),
+    };
+}
+/**
+ * Whether one plugin id still has a footprint in this profile: a grants-file
+ * key, an effect-ledger record, or a storage namespace. The same three sources
+ * the matrix unions — a removal that left something behind is read here rather
+ * than by a second reader that could disagree with the report (C-5).
+ */
+export function pluginFootprintContains(pluginId, overrides = {}) {
+    return pluginFootprints(pluginFootprintPaths(overrides)).includes(pluginId);
+}
 /** `/plugin check <path>`: official parse/projection + profile validation + negotiation. */
 function checkManifestLines(pathArg, deps) {
     const lines = [];
@@ -283,6 +309,14 @@ export function parsePluginArgs(args) {
         return { kind: 'info', spec: rest.join(' ') };
     if (sub === 'registries')
         return { kind: 'registries' };
+    if (sub === 'install')
+        return { kind: 'install', spec: rest.join(' ') };
+    if (sub === 'remove')
+        return { kind: 'remove', target: rest.join(' ') };
+    if (sub === 'enable')
+        return { kind: 'enable', target: rest.join(' ') };
+    if (sub === 'disable')
+        return { kind: 'disable', target: rest.join(' ') };
     return { kind: 'unknown', sub: sub ?? '' };
 }
 /** The `/plugin` overview lines (banner always first). */
@@ -314,9 +348,20 @@ export function pluginsInfoLines(args, deps) {
     }
     if (parsed.kind === 'registries')
         return lines;
-    const dataDir = deps.dataDir ?? DATA_DIR;
-    const ledgerFile = deps.ledgerFile ?? EFFECT_LEDGER_FILE;
-    const storageDir = deps.storageDir ?? join(dataDir, PLUGIN_STORAGE_DIR);
+    // `install <spec>` is the write path (C-4): a bare one is a usage error, and
+    // the UI drives the rest — this half stays the diagnostics it always was.
+    if (parsed.kind === 'install') {
+        if (parsed.spec === '')
+            lines.push(t('plugins-install-usage'));
+        return lines;
+    }
+    // The three lifecycle forms (C-5) report themselves as they run, like an
+    // install: a bare one is a usage error, and this half stays the diagnostics.
+    if (parsed.kind === 'remove' || parsed.kind === 'enable' || parsed.kind === 'disable') {
+        if (parsed.target === '')
+            lines.push(t('plugins-manage-usage', { sub: parsed.kind }));
+        return lines;
+    }
     // ── Host Descriptor ──
     if (deps.host === undefined) {
         lines.push(t('plugins-host-unavailable'));
@@ -336,7 +381,7 @@ export function pluginsInfoLines(args, deps) {
         }
     }
     // ── 授权矩阵 ──
-    const plugins = footprintPlugins(deps, dataDir, ledgerFile, storageDir);
+    const plugins = pluginFootprints(pluginFootprintPaths(deps));
     lines.push(t('plugins-matrix-note'));
     const permissions = deps.grants.knownPermissions();
     if (permissions.length === 0) {
@@ -368,6 +413,7 @@ export function pluginsInfoLines(args, deps) {
         lines.push(`  ${t('plugins-grant-hint')}`);
     }
     // ── 台账尾 ──
+    const ledgerFile = pluginFootprintPaths(deps).ledgerFile;
     const records = readLedgerRecords(ledgerFile);
     if (records.length === 0) {
         lines.push(t('plugins-ledger-empty'));
@@ -382,38 +428,89 @@ export function pluginsInfoLines(args, deps) {
     }
     return lines;
 }
-/** Evaluate a package's declaration exactly as `check <path>` does. */
-function declarationVerdict(deps, packageName) {
-    const declaration = deps.declaration?.(packageName);
-    if (declaration === undefined)
-        return { kind: 'undeclared' };
+/**
+ * A declaration this profile can use: parsed, projected and validated against
+ * the admission catalog — the half `check <path>` and the list tags share. One
+ * implementation, so every surface that judges a declaration is judging the
+ * same thing; the caller decides what to do with the answer (the tag negotiates
+ * it further, the pre-install notice does not).
+ */
+function admitDeclaration(declaration) {
     const data = loadSpecData();
     if (data === undefined)
-        return { kind: 'invalid', error: t('plugins-check-spec-unavailable') };
+        return { error: t('plugins-check-spec-unavailable') };
     let manifest;
     try {
         manifest = parseManifest(declaration.source, { source: declaration.path });
         projectManifest(manifest);
     }
     catch (error) {
-        return { kind: 'invalid', error: cell(error instanceof Error ? error.message : String(error)) };
+        return { error: cell(error instanceof Error ? error.message : String(error)) };
     }
     const index = createContractIndex(data.registry, data.permissions);
     try {
         validatePlugin(index, manifest);
     }
     catch (error) {
-        return { kind: 'invalid', error: cell(error instanceof Error ? error.message : String(error)) };
+        return { error: cell(error instanceof Error ? error.message : String(error)) };
     }
+    return { manifest, index };
+}
+/** Evaluate one declaration exactly as `check <path>` does. */
+function verdictOfDeclaration(deps, declaration) {
+    const admitted = admitDeclaration(declaration);
+    if ('error' in admitted)
+        return { kind: 'invalid', error: admitted.error };
     const host = deps.host;
     if (host === undefined)
         return { kind: 'invalid', error: t('plugins-check-host-unavailable') };
-    const granted = manifest.permissions.map(request => ({
+    const granted = admitted.manifest.permissions.map(request => ({
         name: request.name,
         scope: request.scope,
-        granted: deps.grants.allows({ componentId: manifest.id }, request.name, request.scope),
+        granted: deps.grants.allows({ componentId: admitted.manifest.id }, request.name, request.scope),
     }));
-    return { kind: 'decided', decision: negotiate(index, manifest, host.descriptor, granted) };
+    return { kind: 'decided', decision: negotiate(admitted.index, admitted.manifest, host.descriptor, granted) };
+}
+/** Evaluate a package's declaration exactly as `check <path>` does. */
+function declarationVerdict(deps, packageName) {
+    const declaration = deps.declaration?.(packageName);
+    if (declaration === undefined)
+        return { kind: 'undeclared' };
+    return verdictOfDeclaration(deps, declaration);
+}
+/**
+ * Gate 1's pre-install statement about an install target (C-4), as data.
+ *
+ * It runs the same parse/project/validate pipeline `check <path>` and the list
+ * tags run — one implementation, so the surfaces cannot disagree — over the
+ * declaration of the target directory the caller resolved. It deliberately stops
+ * before `negotiate`: admission's five states are a statement about a *running*
+ * host, and the standing tag in `/plugin` is where they are reported after the
+ * install. What a person needs before installing is narrower and decidable: is
+ * there a declaration at all, and does this profile's catalog accept it.
+ *
+ * The evidence is the target directory and nothing else. A declaration resolved
+ * by package name would be the profile's already-installed copy of that name —
+ * a different artifact from the one being installed (another version, or a local
+ * directory), which is how a stale same-name package used to answer for a new
+ * target.
+ *
+ * The two empty answers are not the same thing, and that is the point:
+ *
+ * - a directory the caller resolved (`install <path>` specs) either carries a
+ *   package-root `dsh-plugin.json` or does not, so no file is `undeclared`;
+ * - a target with no directory to read (a registry name, a tarball, a git spec)
+ *   ships no file this machine can read, so an empty answer there is `unjudged`
+ *   — the flow cannot honestly claim a package it has never seen fails gate 1.
+ */
+export function declarationNoticeFor(target) {
+    if (target.directory === undefined)
+        return { kind: 'unjudged' };
+    const declaration = pluginDeclarationIn(target.directory);
+    if (declaration === undefined)
+        return { kind: 'undeclared' };
+    const admitted = admitDeclaration(declaration);
+    return 'error' in admitted ? { kind: 'invalid', error: admitted.error } : { kind: 'declared' };
 }
 /**
  * The gate-1 tag for one listed package, or `undefined` when it needs none.
@@ -586,8 +683,16 @@ export async function pluginServiceLines(args, deps, manager) {
         return [];
     if (parsed.kind === 'info' && parsed.spec === '')
         return [];
+    // With no service the report is the diagnostics plus the reason and the CLI
+    // route, whatever the form asked for — the write path included: the flow that
+    // would run it lives in the entry, and without a service the entry hands back
+    // no flow, so this is the sentence the person reads.
     if (manager === undefined)
-        return [t('plugins-service-unavailable')];
+        return [t('plugins-service-unavailable'), t('plugins-service-unavailable-route')];
+    // The write paths report themselves line by line as they run (C-4 / C-5): with
+    // a service present, this half has nothing to add to them.
+    if (parsed.kind === 'install' || parsed.kind === 'remove' || parsed.kind === 'enable' || parsed.kind === 'disable')
+        return [];
     // The service belongs to the host: a refusal or a crash there must not take
     // the diagnostics half down with it. Every call funnels into one line, so a
     // rejected promise still leaves a readable report instead of an unhandled

package/lib/types/dsh-adapter/process-exit.d.ts

@@ -23,7 +23,7 @@ export type ExitRequestAnswer = 'exiting' | 'pending' | 'supervising' | 'refused
 export interface ProcessExitSeam {
     request?: (request: ExitRequest) => ExitRequestAnswer;
 }
-/** dsh `profile-boot` PROCESS_SHUTDOWN_TIMEOUT_MS (0.2.0-rc.2): the dispose bound. */
+/** dsh `process-shutdown` PROCESS_SHUTDOWN_TIMEOUT_MS (0.2.1-rc.2): the dispose bound. */
 export declare const PROCESS_SHUTDOWN_TIMEOUT_MS = 5000;
 /**
  * End the process by `signal`. Only the entry's own listeners come off, so the

package/lib/types/dsh-adapter/process-exit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-exit.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/process-exit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAC/D,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAAoC,CAAA;AAEhG,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE;AACjE,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;+CAE+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;AAEjF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,iBAAiB,CAAA;CACtD;AAED,sFAAsF;AACtF,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAQ/C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAQ3D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACvE;AAED,wBAAwB;AACxB,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CA4BrE"}
+{"version":3,"file":"process-exit.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/process-exit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAC/D,eAAO,MAAM,mBAAmB,EAAE,SAAS,iBAAiB,EAAoC,CAAA;AAEhG,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE;AACjE,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;+CAE+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;AAEjF,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,iBAAiB,CAAA;CACtD;AAED,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAQ/C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAQ3D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACvE;AAED,wBAAwB;AACxB,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CA4BrE"}

package/lib/types/dsh-adapter/process-exit.js

@@ -6,7 +6,7 @@
  * tmux and service managers); a second signal forces the exit at once.
  */
 export const TERMINATION_SIGNALS = ['SIGTERM', 'SIGHUP', 'SIGINT'];
-/** dsh `profile-boot` PROCESS_SHUTDOWN_TIMEOUT_MS (0.2.0-rc.2): the dispose bound. */
+/** dsh `process-shutdown` PROCESS_SHUTDOWN_TIMEOUT_MS (0.2.1-rc.2): the dispose bound. */
 export const PROCESS_SHUTDOWN_TIMEOUT_MS = 5000;
 /** Last-resort bound for a funnel exit: outlasts its terminal cleanup plus the dispose bound. */
 const BACKSTOP_MS = PROCESS_SHUTDOWN_TIMEOUT_MS + 2000;

package/lib/types/dsh-adapter/session-projection-store.d.ts

@@ -0,0 +1,66 @@
+/**
+ * One host session-projection key, folded for the session on screen.
+ *
+ * The host projection feed is process-wide and carries whole values, so a
+ * read side needs the same three pieces every time: drop other keys, narrow
+ * the wire value with a local guard (the producer package is never imported),
+ * and read one baseline snapshot when a session binds — a value is only
+ * published on change, so a resumed session would otherwise wait for its next
+ * event. The store keeps only the watched session's value: a background
+ * session must not overwrite what the screen shows.
+ *
+ * @module
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ProjectionRegistryLike } from './activity-store.js';
+/** The session whose projection value the session on screen shows. */
+export interface WatchedSession {
+    readonly id: string;
+    /** The live session object, when there is one to read a baseline from. */
+    readonly session?: unknown;
+}
+export interface SessionProjectionStoreOptions<T> {
+    /** Projection key the value is published under. */
+    readonly key: string;
+    /** Narrow one wire value of a session; anything else is dropped, never half-rendered. */
+    narrow(value: unknown, sessionId: string): T | undefined;
+    /** Map the bound session to the session it reads (default: itself). */
+    watch?(session: unknown): WatchedSession;
+    /** Read-failure sink, reported once per attached registry (the composition root's logger). */
+    warn?(message: string): void;
+}
+export interface SessionProjectionStore<T> {
+    /** Remember the host registry; a late registry seeds the bound session. */
+    attachRegistry(registry: ProjectionRegistryLike): void;
+    /** Forget a registry that left; nothing is read from it again and the value clears. */
+    detachRegistry(registry: ProjectionRegistryLike): void;
+    /** Bind the session on screen and read its watched value once. */
+    seed(session: unknown): void;
+    /** Record one value from the change feed. */
+    update(sessionId: string, value: unknown): void;
+    /**
+     * Read the bound session's baseline again. For a change the feed does not
+     * carry: a projection definition that left (its key reads as absent) or
+     * came back.
+     */
+    reseed(): void;
+    /** The bound session's id, once a session bound. */
+    readonly boundId: string | undefined;
+    /** The watched session's id, once a session bound. */
+    readonly watchedId: string | undefined;
+    /** The watched session's current value, stable between updates. */
+    read(): T | undefined;
+    subscribe(listener: () => void): () => void;
+    noteReadFailure(error: unknown): void;
+}
+export declare function createSessionProjectionStore<T>(options: SessionProjectionStoreOptions<T>): SessionProjectionStore<T>;
+/**
+ * Wire one store to the host's projection registry once it exists. The
+ * registry and the unit that publishes the key are mounted by other plugins,
+ * so both may arrive later — or never, which leaves the store empty.
+ * @param ctx - Host context of the composition root.
+ * @param key - Projection key the store folds.
+ * @param store - Store to fill.
+ */
+export declare function attachSessionProjection(ctx: Context, key: string, store: SessionProjectionStore<unknown>): void;
+//# sourceMappingURL=session-projection-store.d.ts.map

package/lib/types/dsh-adapter/session-projection-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-projection-store.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/session-projection-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,6BAA6B,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,yFAAyF;IACzF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAA;IACxD,uEAAuE;IACvE,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAAA;IACxC,8FAA8F;IAC9F,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,2EAA2E;IAC3E,cAAc,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACtD,uFAAuF;IACvF,cAAc,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACtD,kEAAkE;IAClE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,6CAA6C;IAC7C,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/C;;;;OAIG;IACH,MAAM,IAAI,IAAI,CAAA;IACd,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,mEAAmE;IACnE,IAAI,IAAI,CAAC,GAAG,SAAS,CAAA;IACrB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;IAC3C,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CACtC;AASD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAsFpH;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,IAAI,CAmB/G"}

package/lib/types/dsh-adapter/session-projection-store.js

@@ -0,0 +1,149 @@
+/**
+ * One host session-projection key, folded for the session on screen.
+ *
+ * The host projection feed is process-wide and carries whole values, so a
+ * read side needs the same three pieces every time: drop other keys, narrow
+ * the wire value with a local guard (the producer package is never imported),
+ * and read one baseline snapshot when a session binds — a value is only
+ * published on change, so a resumed session would otherwise wait for its next
+ * event. The store keeps only the watched session's value: a background
+ * session must not overwrite what the screen shows.
+ *
+ * @module
+ */
+/** A raw value no snapshot can return: the next update always narrows. */
+const UNREAD = Symbol('unread');
+function sessionIdOf(session) {
+    return String(session.id);
+}
+export function createSessionProjectionStore(options) {
+    const listeners = new Set();
+    let registry;
+    let bound;
+    let watched;
+    let raw;
+    let value;
+    let warned = false;
+    const emit = () => {
+        for (const listener of [...listeners])
+            listener();
+    };
+    const store = {
+        attachRegistry(next) {
+            registry = next;
+            warned = false;
+            if (bound !== undefined)
+                store.seed(bound);
+        },
+        detachRegistry(left) {
+            if (registry !== left)
+                return;
+            registry = undefined;
+            raw = undefined;
+            if (value === undefined)
+                return;
+            value = undefined;
+            emit();
+        },
+        seed(session) {
+            if (session === null || session === undefined)
+                return;
+            bound = session;
+            const next = options.watch?.(session) ?? { id: sessionIdOf(session), session };
+            if (next.id !== watched?.id) {
+                raw = undefined;
+                if (value !== undefined) {
+                    value = undefined;
+                    emit();
+                }
+            }
+            watched = next;
+            if (registry === undefined || next.session === undefined)
+                return;
+            try {
+                store.update(next.id, registry.snapshot(next.session, [options.key]).values[options.key]);
+            }
+            catch (error) {
+                store.noteReadFailure(error);
+            }
+        },
+        update(sessionId, next) {
+            if (sessionId !== watched?.id)
+                return;
+            // The host reuses the value reference while its state is unchanged, so
+            // identity is the whole change test.
+            if (next === raw)
+                return;
+            raw = next;
+            const narrowed = options.narrow(next, sessionId);
+            if (narrowed === undefined && value === undefined)
+                return;
+            value = narrowed;
+            emit();
+        },
+        reseed() {
+            if (bound === undefined)
+                return;
+            // The narrow may read host state the value reference does not track
+            // (the team's service presence), so an unchanged value, an absent one
+            // included, is re-narrowed.
+            const held = raw;
+            raw = UNREAD;
+            store.seed(bound);
+            // No snapshot was read (no registry, the watched session not live, or a
+            // failed read): narrow the value already held instead.
+            if (raw === UNREAD && held !== UNREAD && watched !== undefined)
+                store.update(watched.id, held);
+        },
+        get boundId() {
+            return bound === undefined ? undefined : sessionIdOf(bound);
+        },
+        get watchedId() {
+            return watched?.id;
+        },
+        read: () => value,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => { listeners.delete(listener); };
+        },
+        noteReadFailure(error) {
+            if (warned)
+                return;
+            warned = true;
+            const detail = error instanceof Error ? error.message : String(error);
+            options.warn?.(`dsh-tui: ${options.key} projection read failed: ${detail}`);
+        },
+    };
+    return store;
+}
+/**
+ * Wire one store to the host's projection registry once it exists. The
+ * registry and the unit that publishes the key are mounted by other plugins,
+ * so both may arrive later — or never, which leaves the store empty.
+ * @param ctx - Host context of the composition root.
+ * @param key - Projection key the store folds.
+ * @param store - Store to fill.
+ */
+export function attachSessionProjection(ctx, key, store) {
+    ctx.inject(['sessionProjections'], ((projectionCtx) => {
+        const registry = projectionCtx.sessionProjections;
+        if (registry === undefined)
+            return;
+        store.attachRegistry(registry);
+        let offFeed;
+        try {
+            offFeed = registry.onChanged((session, changed, value) => {
+                if (changed === key)
+                    store.update(sessionIdOf(session), value);
+            });
+        }
+        catch (error) {
+            store.noteReadFailure(error);
+        }
+        // On the injected fiber: a re-provided registry re-runs this callback.
+        projectionCtx.effect(() => () => {
+            offFeed?.();
+            store.detachRegistry(registry);
+        }, `dsh-tui ${key} projection feed`);
+    }));
+}

package/lib/types/dsh-adapter/settingsEditor.js

@@ -183,7 +183,7 @@ export class SettingsForm {
             if (field.secret !== undefined) {
                 // Blank drafts write nothing; typed drafts replace the credential.
                 if (staged.text !== '')
-                    secrets.push({ ref: field.secret.ref, text: staged.text });
+                    secrets.push({ ref: field.secret.ref, text: staged.text, field });
                 continue;
             }
             const write = staged.clear ? { kind: 'clear' } : defaultParse(field, staged.text);
@@ -210,7 +210,7 @@ export class SettingsForm {
                 }
             }
             for (const secret of secrets) {
-                await this.host.writeCredential(secret.ref, secret.text);
+                await this.host.writeCredential(secret.ref, secret.text, secret.field.secret?.authorization);
             }
             for (const [key, edit] of snapshot) {
                 if (this.edits.get(key) === edit)

package/lib/types/dsh-adapter/sideQuestion.d.ts

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import type { Agent } from '@deepseek-ai/dsh-agent';
 import { type ContentBlock, type Message, type StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { SessionEvent } from '@deepseek-ai/dsh-session';
 type ToolCall = Extract<ContentBlock, {
@@ -71,5 +72,25 @@ export declare function runSideQuestion(params: {
     /** Cancellation: aborting yields `{answer: null}` with no error text. */
     signal?: AbortSignal;
 }): Promise<SideQuestionOutcome>;
+/** The `agents` service as {@link runAsSideBranch} needs it. */
+export interface InitiatorScope {
+    withInitiator<T>(agent: Agent, operation: () => T): T;
+}
+/**
+ * Run a side question with a seeded fork of `agent` as its initiator. The
+ * call replays the session's history without entering it, which DSH models as
+ * a fork (`parentSession` + `isSeeded` on the child header). Initiator-keyed
+ * consumers then see a branch of the conversation rather than an agentless
+ * call: a compressing proxy (billion-context) adopts the parent's state for
+ * the branch instead of sending the raw replay, which overflows long sessions.
+ * Without the service, or once its scope is closing, the call runs as before.
+ *
+ * The view is no stored Session: `session.id` carries the branch identity
+ * while `header.id` deliberately keeps the parent's (a stored fork's header id
+ * mirrors its own session). The verified consumer path reads `session.id`;
+ * aligning `header.id` changes what a parent-resolving consumer sees and needs
+ * the same real-host recheck. scripts/verify-preset-patch.ts pins this shape.
+ */
+export declare function runAsSideBranch<T>(agents: Partial<InitiatorScope> | undefined, agent: Agent, operation: () => Promise<T>): Promise<T>;
 export {};
 //# sourceMappingURL=sideQuestion.d.ts.map

package/lib/types/dsh-adapter/sideQuestion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sideQuestion.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/sideQuestion.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAkB,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAI5D,KAAK,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAA;AAK5D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,CAG5F;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;IACpG,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAA;CACpB,CA2BA;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUhF;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,yEAAyE;IACzE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,CAAC,WAAW,CAAC,CAAA;IACvD,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,yEAAyE;IACzE,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB/B"}
+{"version":3,"file":"sideQuestion.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/sideQuestion.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AACnD,OAAO,EAAkB,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAK5D,KAAK,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAA;AAK5D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,QAAQ,EAAO,GAAG,MAAM,CAG5F;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;IACpG,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;IAC5B,OAAO,EAAE,QAAQ,EAAE,CAAA;CACpB,CA2BA;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUhF;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,yEAAyE;IACzE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,CAAC,WAAW,CAAC,CAAA;IACvD,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,yEAAyE;IACzE,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuB/B;AAED,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAA;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOrI"}

package/lib/types/dsh-adapter/sideQuestion.js

@@ -7,6 +7,7 @@
  * @module
  */
 import { BlockAssembler } from '@deepseek-ai/dsh-llm';
+import { randomUUID } from 'node:crypto';
 import { sideQuestionPrompt } from '../channel/side-prompts.js';
 import { answeredToolCallIds } from './compat/messages.js';
 /** Per-call argument budget in the pending-calls note; a file write can carry megabytes. */
@@ -143,3 +144,55 @@ export async function runSideQuestion(params) {
         return { answer: null, error: 'No response received' };
     return { answer };
 }
+/**
+ * Run a side question with a seeded fork of `agent` as its initiator. The
+ * call replays the session's history without entering it, which DSH models as
+ * a fork (`parentSession` + `isSeeded` on the child header). Initiator-keyed
+ * consumers then see a branch of the conversation rather than an agentless
+ * call: a compressing proxy (billion-context) adopts the parent's state for
+ * the branch instead of sending the raw replay, which overflows long sessions.
+ * Without the service, or once its scope is closing, the call runs as before.
+ *
+ * The view is no stored Session: `session.id` carries the branch identity
+ * while `header.id` deliberately keeps the parent's (a stored fork's header id
+ * mirrors its own session). The verified consumer path reads `session.id`;
+ * aligning `header.id` changes what a parent-resolving consumer sees and needs
+ * the same real-host recheck. scripts/verify-preset-patch.ts pins this shape.
+ */
+export function runAsSideBranch(agents, agent, operation) {
+    if (typeof agents?.withInitiator !== 'function')
+        return operation();
+    try {
+        return agents.withInitiator(sideBranchOf(agent), operation);
+    }
+    catch {
+        return operation();
+    }
+}
+function sideBranchOf(agent) {
+    const session = agent.session;
+    const surface = session.surface;
+    const last = surface?.nodes?.at(-1);
+    const generation = surface?.replaceGeneration;
+    const id = last === undefined || generation === undefined
+        ? `${session.id}-btw-${randomUUID()}`
+        : `${session.id}-btw-${generation}-${last}`;
+    // header.id stays the parent's on purpose; see runAsSideBranch.
+    const header = { ...session.header, parentSession: session.id, isSeeded: true };
+    return readThrough(agent, { session: readThrough(session, { id, header }) });
+}
+/**
+ * A view of `target` with some properties replaced. Everything else, methods
+ * included, still acts on `target` (a mutating call reaches the real
+ * session); the view lives only for one side call's stream.
+ */
+function readThrough(target, overrides) {
+    return new Proxy(target, {
+        get(object, key) {
+            if (Object.hasOwn(overrides, key))
+                return overrides[key];
+            const value = Reflect.get(object, key, object);
+            return typeof value === 'function' ? value.bind(object) : value;
+        },
+    });
+}