@deepseek-harness-tui/dsh-tui 0.8.0 → 0.8.2

package/lib/types/dsh-adapter/sanitize.js

@@ -0,0 +1,65 @@
+/**
+ * The render-path sanitization contract for plugin-supplied text — the
+ * single implementation behind every managed-UI seam (dialogs, status line,
+ * entry renderers, rewind modes, decision notices). TUI-PROP-009 Track A
+ * makes these rules normative, so they live in exactly one place:
+ *
+ * - C0/C1 control chars are stripped (replaced by a space) — plugin text
+ *   must never smuggle escape sequences onto the screen;
+ * - whitespace collapses to single spaces (render paths are single-line);
+ * - width is capped in terminal CELLS (never string.length) with an
+ *   ellipsis.
+ *
+ * Non-scalar input is DROPPED, never `String()`-coerced — `String({})`
+ * would put "[object Object]" on the render path. Scalars
+ * (string/number/boolean) coerce through String() first.
+ */
+import { stringWidth } from '../ink/stringWidth.js';
+/** Sanitize an already-string value for the render path. */
+export function cleanRenderText(value, maxCells) {
+    // eslint-disable-next-line no-control-regex -- deliberate: sanitize untrusted render-path text
+    const flat = value.replace(/[\x00-\x1f\x7f-\x9f]/g, ' ').replace(/\s+/g, ' ').trim();
+    if (stringWidth(flat) <= maxCells)
+        return flat;
+    let out = '';
+    for (const ch of flat) {
+        if (stringWidth(out + ch) > maxCells - 1)
+            break;
+        out += ch;
+    }
+    return `${out}…`;
+}
+/**
+ * Sanitize an untrusted (possibly non-string) value. Non-scalars — objects,
+ * arrays, functions, symbols, null/undefined — yield '' so the caller takes
+ * its drop/refuse path; scalars coerce then sanitize.
+ */
+export function cleanScalarText(value, maxCells) {
+    if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean')
+        return '';
+    return cleanRenderText(String(value), maxCells);
+}
+/**
+ * Truncate to a cell budget WITHOUT ellipsis, whitespace folding, or any
+ * other mutation — the editing-path counterpart of {@link cleanRenderText}.
+ * An input panel caps what the user types/pastes; inserting '…' or
+ * collapsing their spaces would corrupt text they can still edit.
+ */
+export function capCells(value, maxCells) {
+    if (stringWidth(value) <= maxCells)
+        return value;
+    let out = '';
+    for (const ch of value) {
+        if (stringWidth(out + ch) > maxCells)
+            break;
+        out += ch;
+    }
+    return out;
+}
+/** C0/C1 control chars → space, nothing else touched. The single-line
+ *  input panel flattens pasted chunks with this (newlines become spaces —
+ *  the panel has no second row for them). */
+export function flattenInline(value) {
+    // eslint-disable-next-line no-control-regex -- deliberate: sanitize untrusted render-path text
+    return value.replace(/[\x00-\x1f\x7f-\x9f]/g, ' ');
+}

package/lib/types/dsh-adapter/scenes.d.ts

@@ -37,6 +37,13 @@ export interface TuiSceneDescriptor {
     title?: string;
     component: React.ComponentType<TuiSceneProps>;
 }
+/** Host-only scene controls used by the channel; omitted from the plugin export. */
+export interface TuiSceneHost {
+    readonly active: TuiSceneDescriptor | undefined;
+    open(id: string): boolean;
+    close(): void;
+    subscribe(listener: () => void): () => void;
+}
 declare module '@deepseek-ai/cordis' {
     interface Context {
         tuiScenes: TuiSceneRuntime;
@@ -53,11 +60,14 @@ export declare const name = "dsh-tui-scenes";
  * takes the whole terminal the way the trajectory scene does.
  */
 export declare class TuiSceneRuntime extends Service {
-    private readonly scenes;
-    private readonly listeners;
-    private current;
     constructor(ctx: Context);
-    register(descriptor: TuiSceneDescriptor): () => void;
+    /**
+     * Register a full-screen scene; returns the dispose function (caller
+     * scopes it with `ctx.effect`). The optional trailing `identity` (the
+     * plugin's own ctx) only feeds the effect ledger's pluginId — omitting it
+     * records `undeclared` (C-060).
+     */
+    register(descriptor: TuiSceneDescriptor, identity?: Context): () => void;
     /**
      * Swap the conversation for the named scene. Returns false (and warns)
      * when no plugin registered that id — a mistyped id must fail visibly in
@@ -69,7 +79,7 @@ export declare class TuiSceneRuntime extends Service {
     get active(): TuiSceneDescriptor | undefined;
     /** UI-side change feed: fired after every open/close/dispose transition. */
     subscribe(listener: () => void): () => void;
-    private notify;
 }
+export declare function getHostSceneRuntime(runtime: TuiSceneRuntime | undefined): TuiSceneHost | undefined;
 export default TuiSceneRuntime;
 //# sourceMappingURL=scenes.d.ts.map

package/lib/types/dsh-adapter/scenes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scenes.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/scenes.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,8DAA8D;IAC9D,EAAE,EAAE,cAAc,UAAU,CAAC,CAAA;IAC7B,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAA;IAChB,mEAAmE;IACnE,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,CAAA;CAC9C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,eAAe,CAAA;KAC3B;CACF;AAED,eAAO,MAAM,IAAI,mBAAmB,CAAA;AAEpC;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,OAAO;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,OAAO,CAAgC;gBAEnC,GAAG,EAAE,OAAO;IAIxB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAiBpD;;;;OAIG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAYzB,KAAK,IAAI,IAAI;IAMb,8DAA8D;IAC9D,IAAI,MAAM,IAAI,kBAAkB,GAAG,SAAS,CAE3C;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,MAAM;CAGf;AAED,eAAe,eAAe,CAAA"}
+{"version":3,"file":"scenes.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/scenes.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAI3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,KAAK,EAAE,OAAO,KAAK,CAAA;IACnB,8DAA8D;IAC9D,EAAE,EAAE,cAAc,UAAU,CAAC,CAAA;IAC7B,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAA;IAChB,mEAAmE;IACnE,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,EAAE,EAAE,MAAM,CAAA;IACV,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,CAAA;CAC9C;AAED,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAA;IAC/C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;IACzB,KAAK,IAAI,IAAI,CAAA;IACb,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC5C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,eAAe,CAAA;KAC3B;CACF;AAED,eAAO,MAAM,IAAI,mBAAmB,CAAA;AAEpC;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,OAAO;gBAC9B,GAAG,EAAE,OAAO;IA6BxB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,IAAI;IAiDxE;;;;OAIG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAMzB,KAAK,IAAI,IAAI;IAMb,8DAA8D;IAC9D,IAAI,MAAM,IAAI,kBAAkB,GAAG,SAAS,CAO3C;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;CAS5C;AAkED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAOlG;AAED,eAAe,eAAe,CAAA"}

package/lib/types/dsh-adapter/scenes.js

@@ -1,5 +1,7 @@
 /** Provider-neutral full-screen scene registry for terminal front doors. */
 import { Service } from '@deepseek-ai/cordis';
+import { activationFiber, bindCallerEffect, compositionRoot, concreteService, requirePluginCaller } from './host-access.js';
+import { componentIdentityOf } from './component-identity.js';
 export const name = 'dsh-tui-scenes';
 /**
  * Small host-only registry; command execution remains owned by dsh-commands.
@@ -11,30 +13,81 @@ export const name = 'dsh-tui-scenes';
  * takes the whole terminal the way the trajectory scene does.
  */
 export class TuiSceneRuntime extends Service {
-    scenes = new Map();
-    listeners = new Set();
-    current;
     constructor(ctx) {
         super(ctx, 'tuiScenes');
+        compositionRoot(ctx);
+        const runtime = this;
+        const state = {
+            scenes: new Map(),
+            owners: new Map(),
+            listeners: new Set(),
+            current: undefined,
+            host: undefined,
+            logger: ctx.logger,
+        };
+        state.host = Object.freeze({
+            get active() {
+                return sceneStateFor(runtime).current;
+            },
+            open(id) {
+                return openScene(runtime, id);
+            },
+            close() {
+                closeScene(runtime);
+            },
+            subscribe(listener) {
+                return subscribeScenes(runtime, listener);
+            },
+        });
+        sceneStates.set(this, state);
     }
-    register(descriptor) {
+    /**
+     * Register a full-screen scene; returns the dispose function (caller
+     * scopes it with `ctx.effect`). The optional trailing `identity` (the
+     * plugin's own ctx) only feeds the effect ledger's pluginId — omitting it
+     * records `undeclared` (C-060).
+     */
+    register(descriptor, identity) {
+        const state = sceneStateFor(this);
+        const caller = requirePluginCaller(this.ctx, 'tuiScenes.register', this);
+        const activationOwner = activationFiber(caller);
+        if (activationOwner === undefined)
+            throw new Error('dsh-tui: tuiScenes.register requires a live activation');
+        const callerIdentity = componentIdentityOf(caller);
+        const suppliedIdentity = identity === undefined ? callerIdentity : componentIdentityOf(identity);
+        if (identity !== undefined && callerIdentity !== undefined && suppliedIdentity !== callerIdentity) {
+            throw new Error('dsh-tui: tuiScenes.register identity belongs to another activation');
+        }
         const id = descriptor.id.trim().toLowerCase();
         if (!/^[a-z][a-z0-9_-]*$/u.test(id))
             throw new TypeError(`invalid TUI scene id: ${descriptor.id}`);
-        if (this.scenes.has(id))
+        if (state.scenes.has(id)) {
+            caller.get('tuiEffectLedger')?.record({
+                operation: 'create',
+                resource: { kind: 'scene', id },
+                result: 'failed',
+                errorCode: 'DUPLICATE_CONTRIBUTION_ID',
+            }, identity);
             throw new Error(`TUI scene "${id}" is already registered`);
-        const normalized = { ...descriptor, id };
-        this.scenes.set(id, normalized);
-        return () => {
-            if (this.scenes.get(id) !== normalized)
+        }
+        const normalized = Object.freeze({ ...descriptor, id });
+        state.scenes.set(id, normalized);
+        state.owners.set(id, activationOwner);
+        caller.get('tuiEffectLedger')?.record({ operation: 'create', resource: { kind: 'scene', id }, result: 'applied' }, identity);
+        const dispose = () => {
+            if (state.scenes.get(id) !== normalized)
                 return;
-            this.scenes.delete(id);
+            state.scenes.delete(id);
+            state.owners.delete(id);
+            caller.get('tuiEffectLedger')?.record({ operation: 'release', resource: { kind: 'scene', id }, result: 'applied' }, identity);
             // Disposing the open scene must not strand the user on a dead screen.
-            if (this.current === normalized) {
-                this.current = undefined;
-                this.notify();
+            if (state.current === normalized) {
+                state.current = undefined;
+                notifyScenes(state, activationOwner);
             }
         };
+        bindCallerEffect(caller, dispose);
+        return dispose;
     }
     /**
      * Swap the conversation for the named scene. Returns false (and warns)
@@ -42,37 +95,98 @@ export class TuiSceneRuntime extends Service {
      * the log, not silently do nothing in the UI.
      */
     open(id) {
-        const scene = this.scenes.get(id.trim().toLowerCase());
-        if (scene === undefined) {
-            this.ctx.logger.warn(`dsh-tui: no TUI scene registered as "${id}"`);
-            return false;
-        }
-        if (scene === this.current)
-            return true;
-        this.current = scene;
-        this.notify();
-        return true;
+        const caller = requirePluginCaller(this.ctx, 'tuiScenes.open', this);
+        const owner = activationFiber(caller);
+        return owner === undefined ? false : openScene(this, id, caller, owner);
     }
     close() {
-        if (this.current === undefined)
-            return;
-        this.current = undefined;
-        this.notify();
+        const caller = requirePluginCaller(this.ctx, 'tuiScenes.close', this);
+        const owner = activationFiber(caller);
+        if (owner !== undefined)
+            closeScene(this, caller, owner);
     }
     /** The scene currently replacing the conversation, if any. */
     get active() {
-        return this.current;
+        const caller = requirePluginCaller(this.ctx, 'tuiScenes.active', this);
+        const owner = activationFiber(caller);
+        const state = sceneStateFor(this);
+        return owner !== undefined && state.current !== undefined && state.owners.get(state.current.id) === owner
+            ? state.current
+            : undefined;
     }
     /** UI-side change feed: fired after every open/close/dispose transition. */
     subscribe(listener) {
-        this.listeners.add(listener);
-        return () => {
-            this.listeners.delete(listener);
-        };
+        const caller = requirePluginCaller(this.ctx, 'tuiScenes.subscribe', this);
+        const owner = activationFiber(caller);
+        if (owner === undefined)
+            return () => { };
+        const dispose = subscribeScenes(this, listener, owner);
+        bindCallerEffect(caller, dispose);
+        return dispose;
+    }
+}
+const sceneStates = new WeakMap();
+function sceneStateFor(runtime) {
+    const state = sceneStates.get(concreteService(runtime));
+    if (state === undefined)
+        throw new Error('tuiScenes host state is unavailable');
+    return state;
+}
+function openScene(runtime, id, caller, owner) {
+    const state = sceneStateFor(runtime);
+    const scene = state.scenes.get(id.trim().toLowerCase());
+    if (scene === undefined) {
+        ;
+        (caller?.logger ?? state.logger).warn(`dsh-tui: no TUI scene registered as "${id}"`);
+        return false;
+    }
+    if (owner !== undefined && state.owners.get(scene.id) !== owner) {
+        caller?.logger.warn(`dsh-tui: scene "${scene.id}" belongs to another activation`);
+        return false;
+    }
+    if (scene === state.current)
+        return true;
+    const previousOwner = state.current === undefined ? undefined : state.owners.get(state.current.id);
+    state.current = scene;
+    notifyScenes(state, previousOwner);
+    return true;
+}
+function closeScene(runtime, caller, owner) {
+    const state = sceneStateFor(runtime);
+    if (state.current === undefined)
+        return;
+    if (owner !== undefined && state.owners.get(state.current.id) !== owner) {
+        caller?.logger.warn(`dsh-tui: scene "${state.current.id}" belongs to another activation`);
+        return;
+    }
+    const previousOwner = state.owners.get(state.current.id);
+    state.current = undefined;
+    notifyScenes(state, previousOwner);
+}
+function subscribeScenes(runtime, listener, owner) {
+    const state = sceneStateFor(runtime);
+    const entry = { owner, listener };
+    state.listeners.add(entry);
+    return () => {
+        state.listeners.delete(entry);
+    };
+}
+function notifyScenes(state, previousOwner) {
+    const currentOwner = state.current === undefined ? undefined : state.owners.get(state.current.id);
+    for (const entry of state.listeners) {
+        if (entry.owner !== undefined && entry.owner !== currentOwner && entry.owner !== previousOwner)
+            continue;
+        entry.listener();
+    }
+}
+export function getHostSceneRuntime(runtime) {
+    if (runtime === undefined)
+        return undefined;
+    try {
+        return sceneStateFor(runtime).host ?? undefined;
     }
-    notify() {
-        for (const listener of this.listeners)
-            listener();
+    catch {
+        return undefined;
     }
 }
 export default TuiSceneRuntime;

package/lib/types/dsh-adapter/settings-sections.d.ts

@@ -86,6 +86,12 @@ export interface TuiSettingsSection {
     /** Editable fields, in display order. */
     fields: readonly TuiSettingsField[];
 }
+/** Host-only settings-section controls used by the TUI bootstrap/channel. */
+export interface TuiSettingsSectionsHost {
+    register(section: TuiSettingsSection): () => void;
+    list(): readonly TuiSettingsSection[];
+    subscribe(listener: () => void): () => void;
+}
 declare module '@deepseek-ai/cordis' {
     interface Context {
         tuiSettingsSections: TuiSettingsSectionsRuntime;
@@ -97,8 +103,6 @@ export declare const name = "dsh-tui-settings-sections";
  * the dsh settings service (`ctx.settings`).
  */
 export declare class TuiSettingsSectionsRuntime extends Service {
-    private readonly sections;
-    private readonly listeners;
     constructor(ctx: Context);
     register(section: TuiSettingsSection): () => void;
     /** Registered sections in registration order. */
@@ -110,7 +114,7 @@ export declare class TuiSettingsSectionsRuntime extends Service {
      * re-read the section list (a plugin (un)loading mid-session changes it).
      */
     subscribe(listener: () => void): () => void;
-    private emit;
 }
+export declare function getHostSettingsSections(runtime: TuiSettingsSectionsRuntime | undefined): TuiSettingsSectionsHost | undefined;
 export default TuiSettingsSectionsRuntime;
 //# sourceMappingURL=settings-sections.d.ts.map

package/lib/types/dsh-adapter/settings-sections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-sections.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/settings-sections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE3D,iEAAiE;AACjE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3E,MAAM,WAAW,sBAAsB;IACrC,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;CACrC;AAED,oEAAoE;AACpE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,wDAAwD;IACxD,OAAO,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAC3C,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB;;;OAGG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACxD;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,yCAAyC;IACzC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACpC;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mBAAmB,EAAE,0BAA0B,CAAA;KAChD;CACF;AAED,eAAO,MAAM,IAAI,8BAA8B,CAAA;AAE/C;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;gBAEtC,GAAG,EAAE,OAAO;IAIxB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,IAAI;IAejD,iDAAiD;IACjD,IAAI,IAAI,SAAS,kBAAkB,EAAE;IAIrC,sDAAsD;IACtD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAInD;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,IAAI;CAGb;AAED,eAAe,0BAA0B,CAAA"}
+{"version":3,"file":"settings-sections.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/settings-sections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAG3D,iEAAiE;AACjE,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3E,MAAM,WAAW,sBAAsB;IACrC,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;CACrC;AAED,oEAAoE;AACpE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,wDAAwD;IACxD,OAAO,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAC3C,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB;;;OAGG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;CACxD;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,yCAAyC;IACzC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACpC;AAED,6EAA6E;AAC7E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAAA;IACjD,IAAI,IAAI,SAAS,kBAAkB,EAAE,CAAA;IACrC,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC5C;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,mBAAmB,EAAE,0BAA0B,CAAA;KAChD;CACF;AAED,eAAO,MAAM,IAAI,8BAA8B,CAAA;AAE/C;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;gBACzC,GAAG,EAAE,OAAO;IAmBxB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,IAAI;IASjD,iDAAiD;IACjD,IAAI,IAAI,SAAS,kBAAkB,EAAE;IAQrC,sDAAsD;IACtD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAQnD;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;CAS5C;AAgED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,0BAA0B,GAAG,SAAS,GAAG,uBAAuB,GAAG,SAAS,CAO5H;AAED,eAAe,0BAA0B,CAAA"}

package/lib/types/dsh-adapter/settings-sections.js

@@ -10,54 +10,134 @@
  * metadata only.
  */
 import { Service } from '@deepseek-ai/cordis';
+import { activationFiber, bindCallerEffect, compositionRoot, concreteService, requirePluginCaller } from './host-access.js';
 export const name = 'dsh-tui-settings-sections';
 /**
  * Small host-only registry; settings storage and validation remain owned by
  * the dsh settings service (`ctx.settings`).
  */
 export class TuiSettingsSectionsRuntime extends Service {
-    sections = new Map();
-    listeners = new Set();
     constructor(ctx) {
         super(ctx, 'tuiSettingsSections');
+        compositionRoot(ctx);
+        const runtime = this;
+        const state = { sections: new Map(), owners: new Map(), listeners: new Set(), host: undefined };
+        state.host = Object.freeze({
+            register(section) {
+                return registerSection(runtime, section);
+            },
+            list() {
+                return [...settingsSectionStateFor(runtime).sections.values()];
+            },
+            subscribe(listener) {
+                return subscribeSections(runtime, listener);
+            },
+        });
+        settingsSectionStates.set(this, state);
     }
     register(section) {
-        const ns = section.ns.trim();
-        if (!/^[a-z][a-z0-9_-]*$/u.test(ns))
-            throw new TypeError(`invalid TUI settings-section namespace: ${section.ns}`);
-        if (this.sections.has(ns))
-            throw new Error(`TUI settings section "${ns}" is already registered`);
-        const normalized = { ...section, ns };
-        this.sections.set(ns, normalized);
-        this.emit();
-        return () => {
-            if (this.sections.get(ns) === normalized) {
-                this.sections.delete(ns);
-                this.emit();
-            }
-        };
+        const caller = requirePluginCaller(this.ctx, 'tuiSettingsSections.register', this);
+        const owner = activationFiber(caller);
+        if (owner === undefined)
+            throw new Error('dsh-tui: tuiSettingsSections.register requires a live activation');
+        const dispose = registerSection(this, section, owner);
+        bindCallerEffect(caller, dispose);
+        return dispose;
     }
     /** Registered sections in registration order. */
     list() {
-        return [...this.sections.values()];
+        const caller = requirePluginCaller(this.ctx, 'tuiSettingsSections.list', this);
+        const owner = activationFiber(caller);
+        return owner === undefined ? [] : [...settingsSectionStateFor(this).sections.entries()]
+            .filter(([ns]) => settingsSectionStateFor(this).owners.get(ns) === owner)
+            .map(([, section]) => section);
     }
     /** The section registered for a namespace, if any. */
     section(ns) {
-        return this.sections.get(ns.trim());
+        const caller = requirePluginCaller(this.ctx, 'tuiSettingsSections.section', this);
+        const owner = activationFiber(caller);
+        const state = settingsSectionStateFor(this);
+        const normalized = ns.trim();
+        return owner !== undefined && state.owners.get(normalized) === owner ? state.sections.get(normalized) : undefined;
     }
     /**
      * Subscribe to register/unregister events so an open settings screen can
      * re-read the section list (a plugin (un)loading mid-session changes it).
      */
     subscribe(listener) {
-        this.listeners.add(listener);
-        return () => {
-            this.listeners.delete(listener);
-        };
-    }
-    emit() {
-        for (const listener of this.listeners)
-            listener();
+        const caller = requirePluginCaller(this.ctx, 'tuiSettingsSections.subscribe', this);
+        const owner = activationFiber(caller);
+        if (owner === undefined)
+            return () => { };
+        const dispose = subscribeSections(this, listener, owner);
+        bindCallerEffect(caller, dispose);
+        return dispose;
+    }
+}
+const settingsSectionStates = new WeakMap();
+function settingsSectionStateFor(runtime) {
+    const state = settingsSectionStates.get(concreteService(runtime));
+    if (state === undefined)
+        throw new Error('tuiSettingsSections host state is unavailable');
+    return state;
+}
+function registerSection(runtime, section, owner) {
+    const state = settingsSectionStateFor(runtime);
+    const ns = section.ns.trim();
+    if (!/^[a-z][a-z0-9_-]*$/u.test(ns))
+        throw new TypeError(`invalid TUI settings-section namespace: ${section.ns}`);
+    if (state.sections.has(ns))
+        throw new Error(`TUI settings section "${ns}" is already registered`);
+    const normalized = Object.freeze({
+        ...section,
+        ns,
+        descriptions: section.descriptions === undefined ? undefined : Object.freeze({ ...section.descriptions }),
+        fields: Object.freeze(section.fields.map(field => Object.freeze({
+            ...field,
+            path: Object.freeze([...field.path]),
+            descriptions: field.descriptions === undefined ? undefined : Object.freeze({ ...field.descriptions }),
+            hintDescriptions: field.hintDescriptions === undefined ? undefined : Object.freeze({ ...field.hintDescriptions }),
+            options: field.options === undefined
+                ? undefined
+                : Object.freeze(field.options.map(option => Object.freeze({ ...option, descriptions: option.descriptions === undefined ? undefined : Object.freeze({ ...option.descriptions }) }))),
+            secret: field.secret === undefined ? undefined : Object.freeze({ ...field.secret }),
+        }))),
+    });
+    state.sections.set(ns, normalized);
+    if (owner !== undefined)
+        state.owners.set(ns, owner);
+    emitSections(state, owner);
+    return () => {
+        if (state.sections.get(ns) !== normalized)
+            return;
+        state.sections.delete(ns);
+        state.owners.delete(ns);
+        emitSections(state, owner);
+    };
+}
+function subscribeSections(runtime, listener, owner) {
+    const state = settingsSectionStateFor(runtime);
+    const entry = { owner, listener };
+    state.listeners.add(entry);
+    return () => {
+        state.listeners.delete(entry);
+    };
+}
+function emitSections(state, changedOwner) {
+    for (const entry of state.listeners) {
+        if (entry.owner !== undefined && entry.owner !== changedOwner)
+            continue;
+        entry.listener();
+    }
+}
+export function getHostSettingsSections(runtime) {
+    if (runtime === undefined)
+        return undefined;
+    try {
+        return settingsSectionStateFor(runtime).host ?? undefined;
+    }
+    catch {
+        return undefined;
     }
 }
 export default TuiSettingsSectionsRuntime;

package/lib/types/dsh-adapter/shortcuts.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Plugin keyboard shortcuts — pi's `pi.registerShortcut`. A plugin binds a
+ * combo (`ctrl+shift+p`, `alt+k`, …) to a handler; the chat screen matches
+ * combos against keypresses that survived every built-in binding and runs
+ * the handler, consuming the key.
+ *
+ * Precedence rule (same philosophy as the command list: a plugin shadows
+ * nothing built in):
+ *
+ * - Combos must carry ctrl or alt (meta) — bare letters are typing, and
+ *   bare Esc/arrows are navigation. Rejected at registration.
+ * - A RESERVED list (every combo the TUI itself binds globally or in the
+ *   prompt editor) is refused at registration with a warning. The list is
+ *   the enforcement of "locals win": collisions can never reach the matcher.
+ * - Overlays (pickers, dialogs, scenes, the session browser) own the
+ *   keyboard while open; shortcuts match only in the plain chat state.
+ *
+ * Handlers are fire-and-forget from the UI's point of view: async handlers
+ * are awaited but their rejection is caught and toasted — a throwing
+ * handler must never break the keyboard for everyone else.
+ */
+import { Context, Service } from '@deepseek-ai/cordis';
+/** Minimal shape of the ink Key flags the matcher reads (kept structurally
+ *  compatible with `Key` from the ui kit without importing React-facing
+ *  modules into the adapter). */
+export interface TuiShortcutKey {
+    ctrl?: boolean;
+    meta?: boolean;
+    super?: boolean;
+    shift?: boolean;
+    return?: boolean;
+    escape?: boolean;
+    tab?: boolean;
+    backspace?: boolean;
+    delete?: boolean;
+    upArrow?: boolean;
+    downArrow?: boolean;
+    leftArrow?: boolean;
+    rightArrow?: boolean;
+    home?: boolean;
+    end?: boolean;
+    pageUp?: boolean;
+    pageDown?: boolean;
+}
+/** Controls that only the Chat input path may use. They are kept out of the
+ * Cordis service object, so one plugin cannot synthesize an input event to
+ * invoke another plugin's shortcut handler. */
+export interface TuiShortcutHost {
+    dispatch(input: string, key: TuiShortcutKey): boolean;
+    setErrorHandler(handler: (combo: string, error: unknown) => void): () => void;
+}
+export interface TuiShortcutOptions {
+    /** One-line description (shown by future /help surfaces; required so
+     *  every binding is discoverable). */
+    description: string;
+    handler: () => void | Promise<void>;
+}
+interface ParsedCombo {
+    readonly raw: string;
+    readonly ctrl: boolean;
+    readonly meta: boolean;
+    readonly shift: boolean;
+    /** Named key flag on the Key object, or undefined for a character key. */
+    readonly named?: keyof TuiShortcutKey;
+    /** Character to match against the ink `input` string (lowercased). */
+    readonly char?: string;
+}
+/**
+ * Parse `ctrl+shift+p` style combos. Returns undefined on anything
+ * malformed or disallowed (no modifier, unknown key name); `allowReserved`
+ * is exposed for tests only.
+ */
+export declare function parseShortcutCombo(raw: string): ParsedCombo | undefined;
+/** Match a keypress against a parsed combo. `input` is ink's input string
+ *  (already the resolved character; ctrl+space arrives as ' '). */
+export declare function matchShortcut(combo: ParsedCombo, input: string, key: TuiShortcutKey): boolean;
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        tuiShortcuts: TuiShortcutRuntime;
+    }
+}
+/** `ctx.tuiShortcuts` — plugin keyboard shortcut registry. */
+export declare class TuiShortcutRuntime extends Service {
+    constructor(ctx: Context);
+    /**
+     * Bind `combo` to `handler`. Invalid, modifier-less, reserved, or
+     * duplicate combos are refused with a logger warning rather than a throw
+     * — a bad binding must not fail the plugin's whole boot.
+     *
+     * Returns the dispose function; the CALLER scopes it to its own fiber
+     * (`ctx.effect(() => dispose)`) — the same contract as `tuiScenes`
+     * registration. (A service method only sees the service's own ctx, so
+     * caller-fiber cleanup cannot happen here.)
+     *
+     * The optional trailing `identity` (the plugin's own ctx) only feeds the
+     * effect ledger's pluginId — omitting it records `undeclared` (C-060).
+     */
+    register(combo: string, options: TuiShortcutOptions, identity?: Context): () => void;
+    /** Registered combos with descriptions (diagnostics / future /help). */
+    list(): readonly {
+        combo: string;
+        description: string;
+    }[];
+}
+export declare function getHostShortcuts(runtime: TuiShortcutRuntime | undefined): TuiShortcutHost | undefined;
+export default TuiShortcutRuntime;
+//# sourceMappingURL=shortcuts.d.ts.map

package/lib/types/dsh-adapter/shortcuts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortcuts.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/shortcuts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAItD;;iCAEiC;AACjC,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;+CAE+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAA;IACrD,eAAe,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC;0CACsC;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,cAAc,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AA6DD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CA8CvE;AAkBD;mEACmE;AACnE,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAiB7F;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,YAAY,EAAE,kBAAkB,CAAA;KACjC;CACF;AAED,8DAA8D;AAC9D,qBAAa,kBAAmB,SAAQ,OAAO;gBACjC,GAAG,EAAE,OAAO;IAwBxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,IAAI;IAmFpF,wEAAwE;IACxE,IAAI,IAAI,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE;CAS1D;AAmCD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAOrG;AAED,eAAe,kBAAkB,CAAA"}