@deepseek-harness-tui/dsh-tui 0.7.3 → 0.8.1

package/lib/types/dsh-adapter/command-attribution.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Command ownership attribution — the data source for the C-041 invoke
+ * checkpoint's per-owner grant decision.
+ *
+ * dsh-commands has NO owner concept (its `normalizeDefinition` rebuilds a
+ * frozen object and drops unknown fields, and its scoped layers key by
+ * agent, not by registrant), and neither realistic access path can carry
+ * the caller's identity to `register` for us: `ctx.get('commands')` is an
+ * accessor that bypasses cordis's `internal/get` waterfall, and an
+ * inject-declared property read resolves before it. So attribution does
+ * NOT try to spy on the registry — it is a MEDIATED REGISTRATION surface,
+ * the same honest-identity pattern as storage.local / messages.observe:
+ * the plugin-host row's `registerCommand(pluginCtx, definition)` supplies a
+ * unique wrapper handler and stamps that actual registered definition with
+ * the verified Component id and activation on success. The invoke checkpoint resolves the
+ * effective definition for its receiving agent first, then looks up that
+ * definition's handler here. This mirrors dsh-commands' scoped shadowing:
+ * same-name definitions in separate agent scopes never share attribution.
+ *
+ * A plugin that registers directly through `ctx.get('commands')` keeps its
+ * command UNATTRIBUTED: the invoke checkpoint then applies the root grant
+ * only — the documented C-070 trusted-in-process boundary, exactly like a
+ * plugin calling `ctx.commands.execute` directly. Attribution only ever
+ * TIGHTENS the check, never widens it.
+ *
+ * The map is keyed by the cordis ROOT so the row and the channel (two
+ * different contexts of one runtime) share one view.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { VerifiedComponentIdentity } from './component-identity.js';
+export interface CommandOwner {
+    componentId: string;
+    activationId: string;
+    commandId: string;
+}
+/** The registrant's display name for diagnostics only: the passed context's
+ * fiber name (nearest named ancestor), 'root' for host-side or degraded
+ * contexts. Authorization never uses this display value. */
+export declare function fiberNameOf(ctx: Context): string;
+/** Record one mediated command definition's owner after successful registration. */
+export declare function stampCommandOwner(ctx: Context, definition: unknown, identity: VerifiedComponentIdentity, commandId: string): void;
+/** Lift one definition's stamp without touching a later registration. */
+export declare function unstampCommandOwner(ctx: Context, definition: unknown, activationId: string): void;
+/**
+ * The recorded owner of the EFFECTIVE command definition, or undefined when
+ * it is unattributed (root-side/direct registrations are the documented
+ * C-070 boundary). Callers must pass `commands.find(agent, name)`, not only
+ * the command name, so agent-scoped shadows select their own owner.
+ */
+export declare function commandOwner(ctx: Context, definition: unknown): CommandOwner | undefined;
+//# sourceMappingURL=command-attribution.d.ts.map

package/lib/types/dsh-adapter/command-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-attribution.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/command-attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AASD;;4DAE4D;AAC5D,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQhD;AAYD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAUN;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAMjG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAKxF"}

package/lib/types/dsh-adapter/command-attribution.js

@@ -0,0 +1,93 @@
+/**
+ * Command ownership attribution — the data source for the C-041 invoke
+ * checkpoint's per-owner grant decision.
+ *
+ * dsh-commands has NO owner concept (its `normalizeDefinition` rebuilds a
+ * frozen object and drops unknown fields, and its scoped layers key by
+ * agent, not by registrant), and neither realistic access path can carry
+ * the caller's identity to `register` for us: `ctx.get('commands')` is an
+ * accessor that bypasses cordis's `internal/get` waterfall, and an
+ * inject-declared property read resolves before it. So attribution does
+ * NOT try to spy on the registry — it is a MEDIATED REGISTRATION surface,
+ * the same honest-identity pattern as storage.local / messages.observe:
+ * the plugin-host row's `registerCommand(pluginCtx, definition)` supplies a
+ * unique wrapper handler and stamps that actual registered definition with
+ * the verified Component id and activation on success. The invoke checkpoint resolves the
+ * effective definition for its receiving agent first, then looks up that
+ * definition's handler here. This mirrors dsh-commands' scoped shadowing:
+ * same-name definitions in separate agent scopes never share attribution.
+ *
+ * A plugin that registers directly through `ctx.get('commands')` keeps its
+ * command UNATTRIBUTED: the invoke checkpoint then applies the root grant
+ * only — the documented C-070 trusted-in-process boundary, exactly like a
+ * plugin calling `ctx.commands.execute` directly. Attribution only ever
+ * TIGHTENS the check, never widens it.
+ *
+ * The map is keyed by the cordis ROOT so the row and the channel (two
+ * different contexts of one runtime) share one view.
+ */
+const ownerMaps = new WeakMap();
+function rootKeyOf(ctx) {
+    const root = ctx.root ?? ctx;
+    return typeof root === 'object' && root !== null ? root : undefined;
+}
+/** The registrant's display name for diagnostics only: the passed context's
+ * fiber name (nearest named ancestor), 'root' for host-side or degraded
+ * contexts. Authorization never uses this display value. */
+export function fiberNameOf(ctx) {
+    try {
+        const resolved = ctx.fiber?.name;
+        if (typeof resolved === 'string' && resolved !== '')
+            return resolved;
+    }
+    catch {
+        // Degraded context without fiber access: 'root'.
+    }
+    return 'root';
+}
+function handlerOf(definition) {
+    try {
+        const handler = definition?.handler;
+        return typeof handler === 'function' ? handler : undefined;
+    }
+    catch {
+        // An exotic definition cannot participate in attribution safely.
+        return undefined;
+    }
+}
+/** Record one mediated command definition's owner after successful registration. */
+export function stampCommandOwner(ctx, definition, identity, commandId) {
+    const key = rootKeyOf(ctx);
+    const handler = handlerOf(definition);
+    if (key === undefined || handler === undefined)
+        return;
+    let map = ownerMaps.get(key);
+    if (map === undefined) {
+        map = new WeakMap();
+        ownerMaps.set(key, map);
+    }
+    map.set(handler, Object.freeze({ componentId: identity.componentId, activationId: identity.activationId, commandId }));
+}
+/** Lift one definition's stamp without touching a later registration. */
+export function unstampCommandOwner(ctx, definition, activationId) {
+    const key = rootKeyOf(ctx);
+    const handler = handlerOf(definition);
+    if (key === undefined || handler === undefined)
+        return;
+    const map = ownerMaps.get(key);
+    if (map?.get(handler)?.activationId === activationId)
+        map.delete(handler);
+}
+/**
+ * The recorded owner of the EFFECTIVE command definition, or undefined when
+ * it is unattributed (root-side/direct registrations are the documented
+ * C-070 boundary). Callers must pass `commands.find(agent, name)`, not only
+ * the command name, so agent-scoped shadows select their own owner.
+ */
+export function commandOwner(ctx, definition) {
+    const key = rootKeyOf(ctx);
+    const handler = handlerOf(definition);
+    if (key === undefined || handler === undefined)
+        return undefined;
+    return ownerMaps.get(key)?.get(handler);
+}

package/lib/types/dsh-adapter/command-errors.d.ts

@@ -0,0 +1,42 @@
+/**
+ * commands contract error-code alignment (C-041,
+ * `commands.dsh/v1alpha1#Command`): the official `dsh-commands` runtime
+ * reports a duplicate registration as a plain `Error` whose MESSAGE is the
+ * only signal:
+ *
+ *   `command "<name>" is already registered (…)`
+ *   `command "<name>" is already registered in this scope`
+ *
+ * The v0.15 contract names the code `DUPLICATE_CONTRIBUTION_ID`. This module
+ * maps the message-shaped error onto an `Error` carrying that `.code`, at
+ * the HOST-MEDIATED registration/invocation points (the channel's skill
+ * command registration and registry-command execution).
+ *
+ * Known boundary (C-070, trusted-in-process): a plugin calling
+ * `ctx.commands.register` / `ctx.commands.execute` DIRECTLY bypasses this
+ * mapping — code-level wrapping can only cover the points the host owns.
+ * That is declared platform behavior, not a bug.
+ */
+/** The contract's command error vocabulary. */
+export declare const COMMAND_ERROR_CODES: readonly ["COMMAND_NOT_FOUND", "DUPLICATE_CONTRIBUTION_ID", "PERMISSION_NOT_GRANTED", "COMMAND_FAILED", "INVOCATION_CANCELLED", "INVOCATION_DEADLINE_EXCEEDED"];
+export type CommandErrorCode = (typeof COMMAND_ERROR_CODES)[number];
+/** An Error carrying a contract error code on `.code`. */
+export interface CodedCommandError extends Error {
+    code: CommandErrorCode;
+    cause?: unknown;
+}
+/**
+ * Map a thrown dsh-commands error onto its contract code. A duplicate
+ * registration comes back as a CodedCommandError with
+ * `DUPLICATE_CONTRIBUTION_ID` (original on `.cause`); every other value
+ * passes through unchanged.
+ */
+export declare function mapCommandError(error: unknown): unknown;
+/** True when `error` carries the given contract code. */
+export declare function hasCommandErrorCode(error: unknown, code: CommandErrorCode): boolean;
+/**
+ * Run `operation` and rethrow any duplicate-registration failure with its
+ * contract code attached (see {@link mapCommandError}).
+ */
+export declare function withCommandErrorMapping<T>(operation: () => T | Promise<T>): Promise<T>;
+//# sourceMappingURL=command-errors.d.ts.map

package/lib/types/dsh-adapter/command-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-errors.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/command-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,iKAOtB,CAAA;AACV,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEnE,0DAA0D;AAC1D,MAAM,WAAW,iBAAkB,SAAQ,KAAK;IAC9C,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASvD;AAED,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAMnF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAM5F"}

package/lib/types/dsh-adapter/command-errors.js

@@ -0,0 +1,63 @@
+/**
+ * commands contract error-code alignment (C-041,
+ * `commands.dsh/v1alpha1#Command`): the official `dsh-commands` runtime
+ * reports a duplicate registration as a plain `Error` whose MESSAGE is the
+ * only signal:
+ *
+ *   `command "<name>" is already registered (…)`
+ *   `command "<name>" is already registered in this scope`
+ *
+ * The v0.15 contract names the code `DUPLICATE_CONTRIBUTION_ID`. This module
+ * maps the message-shaped error onto an `Error` carrying that `.code`, at
+ * the HOST-MEDIATED registration/invocation points (the channel's skill
+ * command registration and registry-command execution).
+ *
+ * Known boundary (C-070, trusted-in-process): a plugin calling
+ * `ctx.commands.register` / `ctx.commands.execute` DIRECTLY bypasses this
+ * mapping — code-level wrapping can only cover the points the host owns.
+ * That is declared platform behavior, not a bug.
+ */
+/** The contract's command error vocabulary. */
+export const COMMAND_ERROR_CODES = [
+    'COMMAND_NOT_FOUND',
+    'DUPLICATE_CONTRIBUTION_ID',
+    'PERMISSION_NOT_GRANTED',
+    'COMMAND_FAILED',
+    'INVOCATION_CANCELLED',
+    'INVOCATION_DEADLINE_EXCEEDED',
+];
+const DUPLICATE_PATTERN = /^command "[^"]+" is already registered/;
+/**
+ * Map a thrown dsh-commands error onto its contract code. A duplicate
+ * registration comes back as a CodedCommandError with
+ * `DUPLICATE_CONTRIBUTION_ID` (original on `.cause`); every other value
+ * passes through unchanged.
+ */
+export function mapCommandError(error) {
+    if (error instanceof Error && DUPLICATE_PATTERN.test(error.message)) {
+        const mapped = new Error(error.message);
+        mapped.name = error.name;
+        mapped.code = 'DUPLICATE_CONTRIBUTION_ID';
+        mapped.cause = error;
+        return mapped;
+    }
+    return error;
+}
+/** True when `error` carries the given contract code. */
+export function hasCommandErrorCode(error, code) {
+    return (error !== null &&
+        typeof error === 'object' &&
+        error.code === code);
+}
+/**
+ * Run `operation` and rethrow any duplicate-registration failure with its
+ * contract code attached (see {@link mapCommandError}).
+ */
+export async function withCommandErrorMapping(operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        throw mapCommandError(error);
+    }
+}

package/lib/types/dsh-adapter/component-identity.d.ts

@@ -0,0 +1,28 @@
+/** Verified Component identity bound to one Cordis activation owner. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ComponentManifest, PluginManifest } from '@dsh-std/manifest';
+export type ComponentIdentityErrorCode = 'COMPONENT_NOT_ADMITTED' | 'COMPONENT_ALREADY_ADMITTED';
+export declare class ComponentIdentityError extends Error {
+    readonly code: ComponentIdentityErrorCode;
+    constructor(code: ComponentIdentityErrorCode, message: string);
+}
+export interface VerifiedComponentIdentity {
+    readonly componentId: string;
+    readonly version: string;
+    readonly facet: 'host';
+    readonly activationId: string;
+    readonly manifest: PluginManifest;
+    readonly projection: ComponentManifest;
+}
+/** Activation ids are host-issued opaque values. Keep them bounded and free
+ * of control characters because the same value is written to the effect
+ * ledger and used as a grant principal selector. */
+export declare const ACTIVATION_ID_MAX_LENGTH = 128;
+export declare function bindComponentIdentity(context: Context, manifest: PluginManifest, projection: ComponentManifest, activationId?: string): VerifiedComponentIdentity;
+export declare function componentIdentityOf(context: Context): VerifiedComponentIdentity | undefined;
+export declare function requireComponentIdentity(context: Context): VerifiedComponentIdentity;
+export declare function declaresPermission(identity: VerifiedComponentIdentity, permission: string, actualScope: string): boolean;
+export declare function declaresCommand(identity: VerifiedComponentIdentity, commandId: string): boolean;
+export declare function declaresObserverScope(identity: VerifiedComponentIdentity, actualScope: string): boolean;
+export declare function requiresDecisionEvents(identity: VerifiedComponentIdentity): boolean;
+//# sourceMappingURL=component-identity.d.ts.map

package/lib/types/dsh-adapter/component-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-identity.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/component-identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAGxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAG1E,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAAG,4BAA4B,CAAA;AAEhG,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAIvE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC;AAED;;oDAEoD;AACpD,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAyB3C,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,iBAAiB,EAC7B,YAAY,GAAE,MAAqB,GAClC,yBAAyB,CA2B3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAM3F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,CASpF;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAQT;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/F;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvG;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAGnF"}

package/lib/types/dsh-adapter/component-identity.js

@@ -0,0 +1,108 @@
+/** Verified Component identity bound to one Cordis activation owner. */
+import { randomUUID } from 'node:crypto';
+import { normalizePermissionScope, scopeCovers } from '../plugin-spec/permission-scope.js';
+export class ComponentIdentityError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ComponentIdentityError';
+    }
+}
+/** Activation ids are host-issued opaque values. Keep them bounded and free
+ * of control characters because the same value is written to the effect
+ * ledger and used as a grant principal selector. */
+export const ACTIVATION_ID_MAX_LENGTH = 128;
+function validateActivationId(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > ACTIVATION_ID_MAX_LENGTH
+        || /[\x00-\x1f\x7f-\x9f]/u.test(value)) {
+        throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', `activationId must be a non-empty control-free string of at most ${ACTIVATION_ID_MAX_LENGTH} characters`);
+    }
+    return value;
+}
+const identities = new WeakMap();
+function ownerKey(context) {
+    try {
+        const fiber = context.fiber;
+        if (typeof fiber === 'object' && fiber !== null)
+            return fiber;
+    }
+    catch {
+        // A real plugin context always has a fiber; reject degraded callers below.
+    }
+    throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', 'a Component activation requires an owning Cordis fiber');
+}
+export function bindComponentIdentity(context, manifest, projection, activationId = randomUUID()) {
+    const key = ownerKey(context);
+    if (identities.has(key)) {
+        throw new ComponentIdentityError('COMPONENT_ALREADY_ADMITTED', 'this activation already has a verified Component identity');
+    }
+    const identity = Object.freeze({
+        componentId: projection.metadata.name,
+        version: projection.metadata.version,
+        facet: 'host',
+        activationId: validateActivationId(activationId),
+        manifest,
+        projection,
+    });
+    identities.set(key, identity);
+    const release = () => {
+        if (identities.get(key) === identity)
+            identities.delete(key);
+    };
+    try {
+        context.effect(() => release);
+    }
+    catch (error) {
+        identities.delete(key);
+        throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', `cannot bind Component identity to an inactive activation: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return identity;
+}
+export function componentIdentityOf(context) {
+    try {
+        return identities.get(ownerKey(context));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function requireComponentIdentity(context) {
+    const identity = componentIdentityOf(context);
+    if (identity === undefined) {
+        throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', 'the calling activation has no verified dsh-plugin.json Component identity');
+    }
+    return identity;
+}
+export function declaresPermission(identity, permission, actualScope) {
+    const actual = normalizePermissionScope(permission, actualScope, identity.componentId);
+    if (actual === undefined)
+        return false;
+    return identity.manifest.permissions.some(request => {
+        if (request.name !== permission)
+            return false;
+        const declared = normalizePermissionScope(permission, request.scope, identity.componentId);
+        return declared !== undefined && scopeCovers(declared, actual);
+    });
+}
+export function declaresCommand(identity, commandId) {
+    return identity.manifest.contributes.commands.some(command => command.id === commandId);
+}
+export function declaresObserverScope(identity, actualScope) {
+    const actual = normalizePermissionScope('messages.observe.read', actualScope, identity.componentId);
+    if (actual === undefined)
+        return false;
+    return identity.manifest.subscriptions.some(subscription => {
+        if (typeof subscription === 'string')
+            return subscription === 'messages.observe';
+        if (subscription.apiVersion !== 'messages.dsh/v1alpha1' || subscription.kind !== 'MessageObserver')
+            return false;
+        if (subscription.scope === undefined)
+            return true;
+        const declared = normalizePermissionScope('messages.observe.read', subscription.scope, identity.componentId);
+        return declared !== undefined && scopeCovers(declared, actual);
+    });
+}
+export function requiresDecisionEvents(identity) {
+    return identity.manifest.requires.contracts.some(requirement => requirement.apiVersion === 'tui.dsh/v1alpha1' && requirement.kind === 'DecisionEvents');
+}

package/lib/types/dsh-adapter/contract.d.ts

@@ -1,11 +1,11 @@
-export declare const UPSTREAM_VALIDATED_VERSION = "0.1.0-rc.6";
+export declare const UPSTREAM_VALIDATED_VERSION = "0.1.0-rc.7";
 /**
  * Framework packages version on their own lines; the contract validates
  * their MAJOR (breaking surface), not the harness rc number.
  */
 export declare const UPSTREAM_FRAMEWORK_MAJORS: Record<string, number>;
 /** Official packages the adapter consumes at runtime or as types. */
-export declare const UPSTREAM_BLESSED_PACKAGES: readonly ["@deepseek-ai/cordis", "@deepseek-ai/schemastery", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-presets", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-cordis-host-runner", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-persona", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-storage", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-storage-json", "@deepseek-ai/dsh-workspace", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-terminal", "@deepseek-ai/dsh-terminal-bash", "@deepseek-ai/dsh-tool-ask-user", "@deepseek-ai/dsh-tool-bash-persistent", "@deepseek-ai/dsh-tool-cordis", "@deepseek-ai/dsh-user-approval", "@deepseek-ai/dsh-user-questions"];
+export declare const UPSTREAM_BLESSED_PACKAGES: readonly ["@deepseek-ai/cordis", "@deepseek-ai/schemastery", "@deepseek-ai/dsh-invariants", "@deepseek-ai/dsh-agent", "@deepseek-ai/dsh-agent-instructions", "@deepseek-ai/dsh-agent-presets", "@deepseek-ai/dsh-atomic-write", "@deepseek-ai/dsh-commands", "@deepseek-ai/dsh-cordis-host-runner", "@deepseek-ai/dsh-llm", "@deepseek-ai/dsh-persona", "@deepseek-ai/dsh-session", "@deepseek-ai/dsh-skill", "@deepseek-ai/dsh-storage", "@deepseek-ai/dsh-storage-domain", "@deepseek-ai/dsh-storage-json", "@deepseek-ai/dsh-workspace", "@deepseek-ai/dsh-system-prompt", "@deepseek-ai/dsh-terminal", "@deepseek-ai/dsh-terminal-bash", "@deepseek-ai/dsh-tool-ask-user", "@deepseek-ai/dsh-tool-bash-persistent", "@deepseek-ai/dsh-tool-cordis", "@deepseek-ai/dsh-user-approval", "@deepseek-ai/dsh-user-questions"];
 export interface UpstreamDriftEntry {
     package: string;
     installed: string | undefined;

package/lib/types/dsh-adapter/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/contract.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG5D,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,6vBAyB5B,CAAA;AAEV,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB;AAWD,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAgB9E;AAOD;;;GAGG;AACH,wBAAgB,aAAa,IAAI,kBAAkB,EAAE,CAsBpD"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/contract.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG5D,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,8xBA0B5B,CAAA;AAEV,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB;AAWD,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAgB9E;AAOD;;;GAGG;AACH,wBAAgB,aAAa,IAAI,kBAAkB,EAAE,CAsBpD"}

package/lib/types/dsh-adapter/contract.js

@@ -1,7 +1,7 @@
 /**
  * Upstream compatibility contract.
  *
- * The TUI is validated against one upstream release line (0.1.0-rc.6).
+ * The TUI is validated against one upstream release line (0.1.0-rc.7).
  * Every official package this adapter touches is blessed here; anything
  * else must go through upstream channels or the adapter, never the UI.
  *
@@ -11,7 +11,7 @@
  */
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-export const UPSTREAM_VALIDATED_VERSION = '0.1.0-rc.6';
+export const UPSTREAM_VALIDATED_VERSION = '0.1.0-rc.7';
 /**
  * Framework packages version on their own lines; the contract validates
  * their MAJOR (breaking surface), not the harness rc number.
@@ -28,6 +28,7 @@ export const UPSTREAM_BLESSED_PACKAGES = [
     '@deepseek-ai/dsh-agent',
     '@deepseek-ai/dsh-agent-instructions',
     '@deepseek-ai/dsh-agent-presets',
+    '@deepseek-ai/dsh-atomic-write',
     '@deepseek-ai/dsh-commands',
     '@deepseek-ai/dsh-cordis-host-runner',
     '@deepseek-ai/dsh-llm',

package/lib/types/dsh-adapter/decision-guard.d.ts

@@ -0,0 +1,84 @@
+/**
+ * RFC 0005 D-7 enforcement: subscribing to an intercept-class (decision)
+ * event requires an explicit host-side grant — default deny.
+ *
+ * Interception is strictly more powerful than observation: a plugin that can
+ * veto user input or a session switch can change what the user's intent
+ * actually does. So `tui/input`, `tui/rewind-prompt`, `tui/session-switch`
+ * and `tui/compact` are NOT free-for-all `ctx.on` targets: the subscribing
+ * plugin (identified by its verified Component identity) must hold the
+ * matching `domain.resource.intercept` grant. Grant answers
+ * come from the unified 8-permission GrantStore in ./grants.js (registry-
+ * driven defaults, `grants`/`denies` sections, corrupt fail-closed) — this
+ * module is only the subscribe-time CHECKPOINT: which event needs which
+ * permission, and the cordis bail hook that enforces it.
+ *
+ * A denied subscription never enters the dispatch chain — it is "as if
+ * unregistered" (D-7) and the caller gets a no-op disposer plus a logger
+ * warning naming the plugin, the event, and the missing grant.
+ *
+ * Re-check semantics (D-7: subscription, revocation, scope change): every
+ * operation reads the live GrantStore and grant-owned registrations are
+ * released when its change watcher observes a revocation.
+ *
+ * Mechanism: cordis bails `internal/listener` on EVERY `ctx.on` before
+ * registering, with `this` bound to the subscribing context; a truthy bail
+ * result skips the registration and becomes the caller's disposer. That is
+ * the whole hook — no patching of the events service.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { EXTENSION_GRANTS_FILE, type GrantStore } from './grants.js';
+import { type VerifiedComponentIdentity } from './component-identity.js';
+/** The intercept permission each decision event requires (D-7 naming:
+ *  `domain.resource.intercept`). Observe-class events (tui/rewind-done,
+ *  tui/session-switched) are deliberately absent. */
+export declare const DECISION_EVENT_PERMISSIONS: Readonly<Record<string, string>>;
+export { EXTENSION_GRANTS_FILE };
+/** @deprecated Use GrantStore from ./grants.js (same shape, plus more). */
+export type ExtensionGrants = GrantStore;
+/** @deprecated Use parseGrantStore from ./grants.js. */
+export declare const parseExtensionGrants: (text: string) => GrantStore;
+/** @deprecated Use readGrantStore from ./grants.js. */
+export declare const readExtensionGrants: (dir?: string) => GrantStore;
+export interface DecisionHandlerMetadata {
+    componentId: string;
+    activationId: string;
+    event: string;
+    order: string;
+}
+/** A host-mediated DecisionEvents registration.  The registry is deliberately
+ * separate from Cordis' private `_hooks`: admission and dispatch must not
+ * depend on plugin load order or on an implementation detail of the event
+ * service. */
+export interface DecisionRegistrationOptions {
+    /** Scope covered by this handler. When omitted it is derived from the
+     * manifest declaration; an unsafe concrete-session declaration is refused. */
+    scope?: string;
+    /** Deterministic order key. Handlers with the same activation/event must use
+     * distinct keys; registration order is never used as a policy. */
+    order?: string;
+}
+export interface RegisteredDecisionHandler {
+    readonly event: string;
+    readonly scope: string;
+    readonly componentId: string;
+    readonly activationId: string;
+    readonly order: string;
+    readonly identity: VerifiedComponentIdentity;
+    readonly ownerContext: Context;
+    readonly listener: (payload: Record<string, unknown>) => unknown;
+}
+export interface DecisionRegistry {
+    grants: GrantStore;
+    handlers: Map<string, Map<string, RegisteredDecisionHandler>>;
+}
+export declare function decisionRegistryOf(ctx: Context): DecisionRegistry;
+/** Return a stable snapshot of handlers for one event and payload scope. */
+export declare function decisionHandlersOf(ctx: Context, event: string, payloadScope?: string): readonly RegisteredDecisionHandler[];
+/** Host-only registration used by TuiPluginHostRuntime. */
+export declare function registerDecisionHandler(pluginCtx: Context, identity: VerifiedComponentIdentity, event: string, listener: (payload: Record<string, unknown>) => unknown, options?: DecisionRegistrationOptions, onRelease?: () => void): () => boolean;
+/** Execute ctx.on for one host-mediated decision registration. */
+export declare function withDecisionRegistration<T>(ctx: Context, callback: () => T): T;
+export declare function decisionHandlerMetadataOf(listener: Function): DecisionHandlerMetadata | undefined;
+export declare function installDecisionGuard(ctx: Context, grants: GrantStore): void;
+//# sourceMappingURL=decision-guard.d.ts.map

package/lib/types/dsh-adapter/decision-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/decision-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EACL,qBAAqB,EAGrB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAQhC;;qDAEqD;AACrD,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKvE,CAAA;AAMD,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,UAAU,CAAA;AAExC,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAA4B,CAAA;AAEjF,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAA2B,CAAA;AAgB/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAGD;;;cAGc;AACd,MAAM,WAAW,2BAA2B;IAC1C;kFAC8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;sEACkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAA;CAC9D;AAsBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEjE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,SAAS,yBAAyB,EAAE,CA6BtC;AAsCD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,yBAAyB,EACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,MAAM,OAAO,CA4Ff;AAkBD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9E;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,uBAAuB,GAAG,SAAS,CAEjG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+D3E"}