@deepseek-harness-tui/dsh-tui 0.8.0 → 0.8.1

package/lib/types/dsh-adapter/plugin-storage.js

@@ -0,0 +1,385 @@
+/**
+ * storage.local contract surface (C-040, `storage.dsh/v1alpha1#LocalStorage`):
+ * per-plugin private persistence, mounted by the dsh-tui-plugin-host row as
+ * `ctx.tuiPluginStorage`.
+ *
+ * The plugin-facing API is `open(ctx)` → `{ get, set, delete }`:
+ *
+ * - VERIFIED IDENTITY: the namespace is derived from the admitted Component
+ *   identity bound to the PASSED activation — there is no parameter to name
+ *   another plugin, so cross-plugin access is rejected by construction.
+ * - GRANTS AT CALL TIME: `get` requires `storage.local.read`, `set`/`delete`
+ *   require `storage.local.write` — checked per call against the live grant
+ *   store (a revoked grant blocks the very next operation without restart).
+ * - Backend: `~/.dsh-tui/plugin-storage/<namespace>.json`, one flat JSON
+ *   object per namespace. Writes go through dsh-atomic-write (`withFileLock`
+ *   for the read-modify-write cycle + `writeFileAtomic` for the commit), and
+ *   an in-process per-namespace promise chain serializes operations in
+ *   invocation order (contract concurrency rule — the lock alone does not
+ *   order contenders).
+ * - QUOTA (host-defined): 256 keys AND 256 KiB of serialized content per
+ *   namespace; a `set` that would cross either fails with QUOTA_EXCEEDED and
+ *   changes nothing.
+ * - Keys stay ordinary data even when they collide with Object.prototype
+ *   names ("__proto__", "toString", "constructor"): namespace tables are
+ *   null-prototype and membership is decided with Object.hasOwn. Values
+ *   must be EXACT JSON values — inputs JSON.stringify would silently
+ *   mutate (undefined, NaN/±Infinity, functions, class instances, sparse
+ *   arrays, cycles) are rejected instead of round-tripping a lie.
+ * - A corrupt namespace file is NEVER overwritten silently: every operation
+ *   fails with STORAGE_UNAVAILABLE and the bytes stay on disk for manual
+ *   recovery. Closing a handle (plugin unload) retains data (contract
+ *   cleanup rule); later calls on a closed handle fail STORAGE_UNAVAILABLE.
+ * - privacyClass: sensitive — keys AND values are never logged.
+ */
+import { mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeFileAtomic, withFileLock } from '@deepseek-ai/dsh-atomic-write';
+import { Service } from '@deepseek-ai/cordis';
+import { validateDeleteInput, validateGetInput, validateSetInput, validateGetOutput, validateSetOutput, validateDeleteOutput, } from '@dsh-std/storage';
+import { DATA_DIR } from '../utils/paths.js';
+import { declaresPermission, requireComponentIdentity } from './component-identity.js';
+import { readGrantStore } from './grants.js';
+/** Quota: max distinct keys per namespace. */
+export const STORAGE_MAX_KEYS = 256;
+/** Quota: max serialized file size per namespace (bytes). */
+export const STORAGE_MAX_BYTES = 256 * 1024;
+/** Max key length (characters). */
+export const STORAGE_KEY_MAX_LENGTH = 128;
+/** Storage failure with the contract's error code on `.code`. */
+export class PluginStorageError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'PluginStorageError';
+        this.code = code;
+    }
+}
+/** Namespace directory under the data dir. */
+export const PLUGIN_STORAGE_DIR = 'plugin-storage';
+/**
+ * Plugin name → safe, collision-free file name. encodeURIComponent keeps
+ * alphanumerics and `- _ . ! ~ * ' ( )`, so scoped names like `@foo/bar`
+ * encode reversibly; pathological results ('', '.', '..') map to '_'.
+ */
+export function storageFileName(plugin) {
+    const encoded = encodeURIComponent(plugin);
+    return encoded === '' || encoded === '.' || encoded === '..' ? '_' : encoded;
+}
+function assertKey(key) {
+    if (typeof key !== 'string' || key === '' || key.length > STORAGE_KEY_MAX_LENGTH || /[\x00-\x1f\x7f-\x9f]/.test(key)) {
+        throw new PluginStorageError('INVALID_KEY', 'storage keys are non-empty control-free strings of at most 128 characters');
+    }
+}
+function validateStorageInput(operation, input) {
+    try {
+        if (operation === 'get')
+            validateGetInput(input);
+        else if (operation === 'set')
+            validateSetInput(input);
+        else
+            validateDeleteInput(input);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (operation !== 'set')
+            throw new PluginStorageError('INVALID_KEY', message);
+        // The standard validator intentionally reports exact-record failures in a
+        // single stream. Preserve the contract's distinction: malformed/missing
+        // `key` is INVALID_KEY; once the key itself is valid, every value/shape
+        // failure (including a missing `value`) is INVALID_VALUE.
+        let keyValid = false;
+        try {
+            const candidate = input;
+            assertKey(candidate?.key);
+            keyValid = true;
+        }
+        catch {
+            keyValid = false;
+        }
+        throw new PluginStorageError(keyValid ? 'INVALID_VALUE' : 'INVALID_KEY', message);
+    }
+}
+/**
+ * Exact JSON values only. JSON.stringify silently MUTATES edge inputs
+ * (NaN/±Infinity → null, undefined array items → null, undefined object
+ * properties dropped, class instances reduced to own fields) — a storage
+ * contract must not round-trip a value the caller never stored, so those
+ * inputs are rejected instead. Accepts: null, boolean, string, finite
+ * number, arrays (dense), and plain objects (Object.prototype or null
+ * prototype only). Every own property is inspected because JSON.stringify
+ * ignores array side-properties, symbols, and non-enumerable fields, while
+ * accessors/toJSON can replace the value being serialized. Those inputs,
+ * cycles, and anything whose inspection throws are rejected.
+ */
+function assertJsonValue(value) {
+    let ok = false;
+    try {
+        ok = isJsonValue(value, new Set());
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok) {
+        throw new PluginStorageError('INVALID_VALUE', 'storage values must be exact JSON values (no undefined, functions, symbols, BigInt, NaN/Infinity, class instances, sparse arrays, or cycles)');
+    }
+}
+function isJsonValue(value, seen) {
+    if (value === null)
+        return true;
+    switch (typeof value) {
+        case 'boolean':
+        case 'string':
+            return true;
+        case 'number':
+            return Number.isFinite(value);
+        case 'object': {
+            const object = value;
+            if (seen.has(object))
+                return false;
+            seen.add(object);
+            try {
+                if (Array.isArray(value)) {
+                    // Array subclasses/custom prototypes can supply an inherited toJSON
+                    // hook. JSON would serialize its replacement, not this array.
+                    if (Object.getPrototypeOf(value) !== Array.prototype)
+                        return false;
+                    if (Object.getOwnPropertySymbols(value).length > 0)
+                        return false;
+                    const ownNames = Object.getOwnPropertyNames(value);
+                    for (const name of ownNames) {
+                        if (name === 'length')
+                            continue;
+                        const descriptor = Object.getOwnPropertyDescriptor(value, name);
+                        // JSON arrays serialize only their indexed elements. Any other
+                        // own property (especially toJSON) would be silently lost.
+                        const index = Number(name);
+                        if (descriptor === undefined || !('value' in descriptor) ||
+                            !Number.isSafeInteger(index) || index < 0 || String(index) !== name || index >= value.length)
+                            return false;
+                    }
+                    for (let index = 0; index < value.length; index++) {
+                        // A sparse hole would serialize as null — a value never stored.
+                        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                        if (descriptor === undefined || !('value' in descriptor))
+                            return false;
+                        if (!isJsonValue(descriptor.value, seen))
+                            return false;
+                    }
+                    return true;
+                }
+                const proto = Object.getPrototypeOf(value);
+                if (proto !== Object.prototype && proto !== null)
+                    return false;
+                // A modified Object.prototype can add an inherited toJSON hook; own
+                // non-enumerable/accessor properties are likewise not exact JSON.
+                if (typeof value.toJSON === 'function')
+                    return false;
+                if (Object.getOwnPropertySymbols(value).length > 0)
+                    return false;
+                for (const name of Object.getOwnPropertyNames(value)) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+                    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor))
+                        return false;
+                    if (!isJsonValue(descriptor.value, seen))
+                        return false;
+                }
+                return true;
+            }
+            finally {
+                // DAGs (shared references without cycles) serialize fine — only
+                // reject a value reachable from ITSELF.
+                seen.delete(object);
+            }
+        }
+        default:
+            // undefined / function / symbol / bigint
+            return false;
+    }
+}
+/**
+ * `ctx.tuiPluginStorage` — storage.local contract surface. Mounted by the
+ * dsh-tui-plugin-host row; grants come from that row's store when present
+ * (normal path) or a private read otherwise (bare mounts in tests).
+ */
+export class TuiPluginStorageRuntime extends Service {
+    grantsOption;
+    fallbackGrants;
+    ledgerOption;
+    namespaces = new Map();
+    dir;
+    constructor(ctx, options = {}) {
+        super(ctx, 'tuiPluginStorage');
+        this.grantsOption = options.grants;
+        this.fallbackGrants = readGrantStore();
+        this.ledgerOption = options.ledger;
+        this.dir = options.dir ?? join(DATA_DIR, PLUGIN_STORAGE_DIR);
+    }
+    /** Grants: the plugin-host row's store when mounted, else a private read.
+     *  Resolved PER CALL — sibling services mounted later by the same apply()
+     *  are not visible to constructors (cordis), so a constructor-time probe
+     *  would silently stick to the fallback. */
+    grants() {
+        return this.grantsOption ?? this.ctx.get('tuiPluginHost')?.grants ?? this.fallbackGrants;
+    }
+    /** Optional observability; a bare mount (tests) simply records nothing. */
+    ledger() {
+        return this.ledgerOption ?? this.ctx.get('tuiEffectLedger');
+    }
+    /**
+     * Open the caller's private namespace. Identity = the PASSED context's
+     * verified Component identity (no way to name another plugin). The handle
+     * closes automatically when the caller's context unloads (idempotent
+     * disposer); data is retained (contract cleanup rule).
+     */
+    open(pluginCtx) {
+        const identity = requireComponentIdentity(pluginCtx);
+        const plugin = identity.componentId;
+        let state = this.namespaces.get(plugin);
+        if (state === undefined) {
+            state = { chain: Promise.resolve() };
+            this.namespaces.set(plugin, state);
+        }
+        this.ledger()?.record({ operation: 'create', resource: { kind: 'storage-namespace', id: plugin }, result: 'applied' }, pluginCtx);
+        // `closed` is PER HANDLE, not per namespace: unloading one fiber must not
+        // kill another handle opened on the same namespace. Close on unload;
+        // idempotent (a double-close stays harmless by design); degraded contexts
+        // without `effect` simply never auto-close.
+        let closed = false;
+        try {
+            pluginCtx.effect(() => () => {
+                if (closed)
+                    return;
+                closed = true;
+                this.ledger()?.record({ operation: 'release', resource: { kind: 'storage-namespace', id: plugin }, result: 'applied' }, pluginCtx);
+            });
+        }
+        catch {
+            // Degraded context: the handle lives until process end.
+        }
+        const file = join(this.dir, `${storageFileName(plugin)}.json`);
+        const grants = () => this.grants();
+        const ledger = () => this.ledger();
+        const enqueue = (operation) => {
+            if (closed) {
+                return Promise.reject(new PluginStorageError('STORAGE_UNAVAILABLE', `storage namespace "${plugin}" handle is closed`));
+            }
+            const run = state.chain.then(operation);
+            // Keep the chain alive after a failure without unhandled rejections.
+            state.chain = run.catch(() => { });
+            return run;
+        };
+        const readTable = () => {
+            let raw;
+            try {
+                raw = readFileSync(file, 'utf8');
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return Object.create(null);
+                throw new PluginStorageError('STORAGE_UNAVAILABLE', `storage namespace "${plugin}" is unreadable; the file was left untouched for manual recovery`);
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                throw new PluginStorageError('STORAGE_UNAVAILABLE', `storage namespace "${plugin}" is corrupt on disk; the file was left untouched for manual recovery`);
+            }
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new PluginStorageError('STORAGE_UNAVAILABLE', `storage namespace "${plugin}" holds a non-object document; the file was left untouched for manual recovery`);
+            }
+            // Rebuild on a NULL-PROTOTYPE table: key membership is decided with
+            // Object.hasOwn, and keys like "__proto__" / "toString" must behave
+            // as ordinary data (a prototype-chain read would leak host objects
+            // into plugin results and fake membership for never-stored keys).
+            const table = Object.create(null);
+            for (const [key, value] of Object.entries(parsed))
+                table[key] = value;
+            return table;
+        };
+        const requireGrant = (permission) => {
+            if (!declaresPermission(identity, permission, plugin)
+                || !grants().allows({ componentId: identity.componentId, activationId: identity.activationId }, permission, plugin)) {
+                ledger()?.record({
+                    operation: 'bind',
+                    resource: { kind: 'permission', id: permission },
+                    result: 'failed',
+                    errorCode: 'PERMISSION_NOT_GRANTED',
+                }, pluginCtx);
+                throw new PluginStorageError('PERMISSION_NOT_GRANTED', `storage.${permission.endsWith('.read') ? 'get' : 'set/delete'} from plugin "${plugin}" denied — grant "${permission}" ` +
+                    `for "${plugin}" in ~/.dsh-tui/extension-grants.json first`);
+            }
+        };
+        // withFileLock creates its lock as a SIBLING of the file and does not
+        // create parent directories — ensure the tree exists before any write
+        // path (read paths tolerate ENOENT as an empty namespace and never
+        // materialize the tree).
+        const ensureDir = () => {
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        };
+        return {
+            get: (input) => enqueue(async () => {
+                validateStorageInput('get', input);
+                const key = input.key;
+                assertKey(key);
+                requireGrant('storage.local.read');
+                const table = readTable();
+                const output = { value: Object.hasOwn(table, key) ? table[key] : null };
+                try {
+                    validateGetOutput(output);
+                }
+                catch {
+                    throw new PluginStorageError('STORAGE_UNAVAILABLE', `storage namespace "${plugin}" contains an invalid JSON value`);
+                }
+                return output;
+            }),
+            set: (input) => enqueue(async () => {
+                validateStorageInput('set', input);
+                const key = input.key;
+                const value = input.value;
+                assertKey(key);
+                assertJsonValue(value);
+                requireGrant('storage.local.write');
+                ensureDir();
+                return withFileLock(file, async () => {
+                    const table = readTable();
+                    const isNewKey = !Object.hasOwn(table, key);
+                    if (isNewKey && Object.keys(table).length >= STORAGE_MAX_KEYS) {
+                        throw new PluginStorageError('QUOTA_EXCEEDED', `storage namespace "${plugin}" holds ${STORAGE_MAX_KEYS} keys already`);
+                    }
+                    table[key] = value;
+                    const content = JSON.stringify(table);
+                    if (Buffer.byteLength(content, 'utf8') > STORAGE_MAX_BYTES) {
+                        throw new PluginStorageError('QUOTA_EXCEEDED', `storage namespace "${plugin}" would exceed ${STORAGE_MAX_BYTES} bytes`);
+                    }
+                    // 0o600/0o700: the namespace is privacyClass sensitive.
+                    await writeFileAtomic(file, content, { mode: 0o600, dirMode: 0o700 });
+                    const output = { stored: true };
+                    validateSetOutput(output);
+                    return output;
+                });
+            }),
+            delete: (input) => enqueue(async () => {
+                validateStorageInput('delete', input);
+                const key = input.key;
+                assertKey(key);
+                requireGrant('storage.local.write');
+                ensureDir();
+                return withFileLock(file, async () => {
+                    const table = readTable();
+                    if (!Object.hasOwn(table, key)) {
+                        const output = { deleted: false };
+                        validateDeleteOutput(output);
+                        return output;
+                    }
+                    delete table[key];
+                    await writeFileAtomic(file, JSON.stringify(table), { mode: 0o600, dirMode: 0o700 });
+                    const output = { deleted: true };
+                    validateDeleteOutput(output);
+                    return output;
+                });
+            }),
+        };
+    }
+}

package/lib/types/dsh-adapter/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAA;AAGhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AA8BnC;;;;;;;;GAQG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkgBvE;AA6GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,GAAG;IACjF,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IACrC,YAAY,EAAE,MAAM,IAAI,CAAA;CACzB,CAcA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;IAC5B,YAAY,EAAE,KAAK,CAAA;CACpB,GAAG,OAAO,CAQV"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAe,MAAM,wBAAwB,CAAA;AAGhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAiCnC;;;;;;;;GAQG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6iBvE;AA6GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,GAAG;IACjF,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IACrC,YAAY,EAAE,MAAM,IAAI,CAAA;CACzB,CAcA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;IAC5B,YAAY,EAAE,KAAK,CAAA;CACpB,GAAG,OAAO,CAQV"}

package/lib/types/dsh-adapter/plugin.js

@@ -21,7 +21,7 @@ import { ensurePackagedPresets } from './packaged-presets.js';
 import { ensureLegacySessionEventTypes } from './compat/index.js';
 import { clearResumeTarget, writeResumeTarget } from '../sessionHistory.js';
 import { resolveSessionCwd } from '../utils/workspaceRoot.js';
-import { checkForTuiUpdate, installedTuiVersion, isVersionNewer, resolveDshProfileName, resolveTuiUpdateTarget, updateTuiAndRestart } from '../update.js';
+import { checkForTuiUpdate, installedTuiVersion, isBootDeadlockTarget, isVersionNewer, resolveDshProfileName, resolveTuiUpdateTarget, updateTuiAndRestart } from '../update.js';
 import { isLang, resolveStartupLang, setLang, t } from '../i18n.js';
 import { detectLegacyEnv, migrateLegacyDataDir, RENAMED_ENV } from '../utils/paths.js';
 import { Chat } from '../screens/Chat.js';
@@ -225,6 +225,24 @@ export async function apply(ctx, config) {
         ctx.logger.warn('dsh-tui: tuiScenes service is not mounted; plugin scenes will never open. ' +
             'The bundle patch is older than the installed dsh-tui package — update the globally installed dsh-tui launcher to match the profile (issue #183).');
     }
+    // Same skew guard for the plugin-UI services (dsh-tui-extensions row):
+    // managed dialogs park unanswered, status contributions never render,
+    // shortcuts never match, and custom-entry renderers stay invisible when
+    // the row is absent — say why on profile launches.
+    if (ctx.get('tuiDialogs') === undefined && resolveDshProfileName() !== undefined) {
+        ctx.logger.warn('dsh-tui: tuiDialogs/tuiStatus/tuiShortcuts/tuiRenderers services are not mounted; plugin dialogs, status contributions, shortcuts and custom-entry renderers are off. ' +
+            'The bundle patch is older than the installed dsh-tui package — update the globally installed dsh-tui launcher to match the profile (issue #183).');
+    }
+    // Same skew guard for the plugin-host row (dsh-tui-plugin-host): without
+    // it there is no runtime generation id, no unified grant store service,
+    // and no Host Descriptor — plugin interop surfaces degrade silently
+    // otherwise. The D-7 decision gate does NOT depend on this row (the
+    // channel installs its own), so interception gating stays intact either
+    // way — what breaks is everything that rides on tuiPluginHost.
+    if (ctx.get('tuiPluginHost') === undefined && resolveDshProfileName() !== undefined) {
+        ctx.logger.warn('dsh-tui: tuiPluginHost service is not mounted; plugin grant store, runtime generation and Host Descriptor are unavailable. ' +
+            'The bundle patch is older than the installed dsh-tui package — update the globally installed dsh-tui launcher to match the profile (issue #183).');
+    }
     const initialWorkspace = requestedWorkspace === undefined
         ? undefined
         : await workspaceService.resolve(requestedWorkspace);
@@ -428,6 +446,12 @@ export async function apply(ctx, config) {
         channel,
         questionStore,
         approvalStore,
+        // The dsh-tui-extensions row's services (managed dialogs, status line,
+        // shortcuts). Soft-consumed: absent the row (stale patch, bare embed),
+        // Chat falls back to inert stores and no shortcut registry.
+        extensionDialogs: ctx.get('tuiDialogs')?.store,
+        extensionStatus: ctx.get('tuiStatus')?.store,
+        extensionShortcuts: ctx.get('tuiShortcuts'),
         // Full-screen surfaces inside Chat — the trajectory scene and the session
         // browser — enter the alt screen themselves in inline mode; in fullscreen
         // the tree is already wrapped below, so they must not nest.
@@ -453,6 +477,21 @@ export async function apply(ctx, config) {
                     channel.notify(t('update-check-failed'));
                 }
                 else {
+                    // 0.7.0/0.7.1 hard-inject tuiWorkspaces at the code level; under
+                    // an older global launcher patch (no service row) that is a
+                    // permanent boot deadlock (issues #183/#307, the exact report
+                    // "pending (waiting for service: tuiWorkspaces)"). A stale mirror
+                    // pinning /update onto that range must be refused, not installed.
+                    if (isBootDeadlockTarget(target.latest)) {
+                        channel.notify(t('update-refused-deadlock', {
+                            latest: target.latest,
+                            authoritative: target.authoritative ?? target.latest,
+                        }), { color: 'warning' });
+                        return;
+                    }
+                    if (target.authoritative !== undefined) {
+                        channel.notify(t('update-mirror-lag', { latest: target.latest, authoritative: target.authoritative }));
+                    }
                     updateTargetVersion = target.latest;
                 }
                 channel.notify(t('update-starting'));
@@ -644,6 +683,11 @@ async function finishExit(ctx, instance, fullscreen, notice, stderrNotice, done)
         const cursor = fullscreen ? '' : cursorMoveToFrameEnd(runtime);
         try {
             runtime?.detachForShutdown?.();
+            // The /update continuation spawns children that inherit this stdin;
+            // strip the readable pump so the parent cannot swallow their input
+            // (issues #284/#307). Harmless on plain exits — the process exits
+            // right after this cleanup anyway.
+            runtime?.detachStdinForHandoff?.();
         }
         catch {
             ctx.logger.debug('dsh-tui: Ink shutdown detach failed; continuing with generic terminal cleanup');
@@ -678,6 +722,8 @@ function readInkShutdownState(value) {
     const candidate = value;
     if (candidate.detachForShutdown !== undefined && typeof candidate.detachForShutdown !== 'function')
         return undefined;
+    if (candidate.detachStdinForHandoff !== undefined && typeof candidate.detachStdinForHandoff !== 'function')
+        return undefined;
     if (candidate.frontFrame !== undefined && !isFrameState(candidate.frontFrame))
         return undefined;
     if (candidate.displayCursor !== undefined && candidate.displayCursor !== null && !isCursorState(candidate.displayCursor))

package/lib/types/dsh-adapter/plugins-info.d.ts

@@ -0,0 +1,43 @@
+/**
+ * /plugins diagnostics surface (C-070 trust disclosure + C-030 negotiation
+ * diagnostics): assembles the lines behind the `/plugins` command.
+ *
+ * Sections (overview):
+ *
+ * 1. TRUST BANNER — always the first line (C-070): plugins run in-process;
+ *    grants are behavioral constraints, not a security boundary; passing
+ *    validation is not proof of safety.
+ * 2. HOST DESCRIPTOR summary — what the running host actually advertises
+ *    (coordinates + generation), including drift-dropped contracts.
+ * 3. GRANT MATRIX — plugins × the registered permissions. The plugin set is
+ *    the union of FOOTPRINTS ONLY: keys of the grants file, pluginIds seen
+ *    in the effect ledger, and storage namespaces on disk (the host cannot
+ *    enumerate installed plugins — that knowledge lives in the dsh CLI
+ *    Loader). The header says so honestly.
+ * 4. LEDGER TAIL — the last 5 effect-ledger records.
+ *
+ * `/plugins check <path>` uses the parser and projection from the pinned
+ * @dsh-std/manifest revision, then evaluates every public/private protocol
+ * through one ProtocolCatalog. Manifests and on-disk files are UNTRUSTED input:
+ * every derived line passes cleanScalarText before it reaches the
+ * transcript.
+ */
+import type { GrantStore } from './grants.js';
+import type { HostDescriptorBuild } from './host-descriptor.js';
+/** How many plugins the matrix shows before an overflow note. */
+export declare const PLUGINS_MATRIX_MAX_ROWS = 20;
+/** How many ledger records the tail section shows. */
+export declare const PLUGINS_LEDGER_TAIL = 5;
+export interface PluginsInfoDeps {
+    /** Effective grant answers (the plugin-host row's store when mounted). */
+    grants: GrantStore;
+    /** The plugin-host row's descriptor build; undefined → row not mounted. */
+    host?: HostDescriptorBuild;
+    /** Test overrides; default under DATA_DIR. */
+    dataDir?: string;
+    ledgerFile?: string;
+    storageDir?: string;
+}
+/** The `/plugins` overview lines (banner always first). */
+export declare function pluginsInfoLines(args: string, deps: PluginsInfoDeps): string[];
+//# sourceMappingURL=plugins-info.d.ts.map

package/lib/types/dsh-adapter/plugins-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugins-info.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/plugins-info.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAYH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAK/D,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,KAAK,CAAA;AACzC,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAIpC,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,MAAM,EAAE,UAAU,CAAA;IAClB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AA2JD,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,MAAM,EAAE,CAmF9E"}