@deepseek-harness-tui/dsh-tui 0.8.1 → 0.8.2

package/lib/types/dsh-adapter/command-attribution.js

@@ -26,10 +26,10 @@
  * The map is keyed by the cordis ROOT so the row and the channel (two
  * different contexts of one runtime) share one view.
  */
+import { compositionRoot } from './host-access.js';
 const ownerMaps = new WeakMap();
 function rootKeyOf(ctx) {
-    const root = ctx.root ?? ctx;
-    return typeof root === 'object' && root !== null ? root : undefined;
+    return compositionRoot(ctx);
 }
 /** The registrant's display name for diagnostics only: the passed context's
  * fiber name (nearest named ancestor), 'root' for host-side or degraded

package/lib/types/dsh-adapter/command-trees.d.ts

@@ -9,6 +9,12 @@ export interface TuiCommandTreeProvider {
     /** Children for the full canonical path, including `root` at index zero. */
     children(canonicalPath: readonly string[]): readonly CommandCompletionNode[];
 }
+/** Host-only completion access. Plugins see only their own provider through
+ * the traceable service; the channel uses this facade to merge all providers. */
+export interface TuiCommandTreeHost {
+    children(canonicalPath: readonly string[]): readonly CommandCompletionNode[];
+    descriptions(root: string): LocalizedDescriptions | undefined;
+}
 declare module '@deepseek-ai/cordis' {
     interface Context {
         tuiCommandTrees: TuiCommandTreeRuntime;
@@ -17,11 +23,11 @@ declare module '@deepseek-ai/cordis' {
 export declare const name = "dsh-tui-command-trees";
 /** Small host-only registry; command execution remains owned by dsh-commands. */
 export declare class TuiCommandTreeRuntime extends Service {
-    private readonly providers;
     constructor(ctx: Context);
     register(provider: TuiCommandTreeProvider): () => void;
     children(canonicalPath: readonly string[]): readonly CommandCompletionNode[];
     descriptions(root: string): LocalizedDescriptions | undefined;
 }
+export declare function getHostCommandTrees(runtime: TuiCommandTreeRuntime | undefined): TuiCommandTreeHost | undefined;
 export default TuiCommandTreeRuntime;
 //# sourceMappingURL=command-trees.d.ts.map

package/lib/types/dsh-adapter/command-trees.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-trees.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/command-trees.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAElF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAAA;CAC7E;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,qBAAqB,CAAA;KACvC;CACF;AAED,eAAO,MAAM,IAAI,0BAA0B,CAAA;AAE3C,iFAAiF;AACjF,qBAAa,qBAAsB,SAAQ,OAAO;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;gBAE1D,GAAG,EAAE,OAAO;IAIxB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI;IAWtD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,qBAAqB,EAAE;IAa5E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;CAG9D;AAED,eAAe,qBAAqB,CAAA"}
+{"version":3,"file":"command-trees.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/command-trees.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAGlF,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAAA;CAC7E;AAED;iFACiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,qBAAqB,EAAE,CAAA;IAC5E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAA;CAC9D;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,qBAAqB,CAAA;KACvC;CACF;AAED,eAAO,MAAM,IAAI,0BAA0B,CAAA;AAE3C,iFAAiF;AACjF,qBAAa,qBAAsB,SAAQ,OAAO;gBACpC,GAAG,EAAE,OAAO;IAYxB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI;IAoBtD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,qBAAqB,EAAE;IAM5E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;CAK9D;AAyCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAO9G;AAED,eAAe,qBAAqB,CAAA"}

package/lib/types/dsh-adapter/command-trees.js

@@ -1,42 +1,92 @@
 /** Provider-neutral subcommand completion registry for terminal front doors. */
 import { Service } from '@deepseek-ai/cordis';
+import { activationFiber, bindCallerEffect, compositionRoot, concreteService, requirePluginCaller } from './host-access.js';
 export const name = 'dsh-tui-command-trees';
 /** Small host-only registry; command execution remains owned by dsh-commands. */
 export class TuiCommandTreeRuntime extends Service {
-    providers = new Map();
     constructor(ctx) {
         super(ctx, 'tuiCommandTrees');
+        compositionRoot(ctx);
+        const runtime = this;
+        const state = { providers: new Map(), owners: new Map(), host: undefined };
+        state.host = Object.freeze({
+            children: path => childrenFor(runtime, path),
+            descriptions: root => descriptionsFor(runtime, root),
+        });
+        commandTreeStates.set(this, state);
     }
     register(provider) {
+        const caller = requirePluginCaller(this.ctx, 'tuiCommandTrees.register', this);
+        const state = commandTreeStateFor(this);
+        const owner = activationFiber(caller);
+        if (owner === undefined)
+            throw new Error('dsh-tui: tuiCommandTrees.register requires a live activation');
         const root = provider.root.trim().toLowerCase();
         if (!/^[a-z][a-z0-9_-]*$/u.test(root))
             throw new TypeError(`invalid TUI command-tree root: ${provider.root}`);
-        if (this.providers.has(root))
+        if (state.providers.has(root))
             throw new Error(`TUI command-tree root "${root}" is already registered`);
         const normalized = { ...provider, root };
-        this.providers.set(root, normalized);
-        return () => {
-            if (this.providers.get(root) === normalized)
-                this.providers.delete(root);
+        state.providers.set(root, normalized);
+        state.owners.set(root, owner);
+        const dispose = () => {
+            if (state.providers.get(root) !== normalized)
+                return;
+            state.providers.delete(root);
+            state.owners.delete(root);
         };
+        bindCallerEffect(caller, dispose);
+        return dispose;
     }
     children(canonicalPath) {
-        const root = canonicalPath[0]?.toLowerCase();
-        if (root === undefined)
-            return [];
-        const provider = this.providers.get(root);
-        if (provider === undefined)
-            return [];
-        try {
-            return provider.children(canonicalPath);
-        }
-        catch {
-            // Completion is optional UI metadata and must never block execution.
-            return [];
-        }
+        const caller = requirePluginCaller(this.ctx, 'tuiCommandTrees.children', this);
+        const owner = activationFiber(caller);
+        return childrenFor(this, canonicalPath, owner);
     }
     descriptions(root) {
-        return this.providers.get(root.trim().toLowerCase())?.descriptions;
+        const caller = requirePluginCaller(this.ctx, 'tuiCommandTrees.descriptions', this);
+        const owner = activationFiber(caller);
+        return descriptionsFor(this, root, owner);
+    }
+}
+const commandTreeStates = new WeakMap();
+function commandTreeStateFor(runtime) {
+    const state = commandTreeStates.get(concreteService(runtime));
+    if (state === undefined)
+        throw new Error('tuiCommandTrees host state is unavailable');
+    return state;
+}
+function childrenFor(runtime, canonicalPath, owner) {
+    const state = commandTreeStateFor(runtime);
+    const root = canonicalPath[0]?.toLowerCase();
+    if (root === undefined || (owner !== undefined && state.owners.get(root) !== owner))
+        return [];
+    const provider = state.providers.get(root);
+    if (provider === undefined)
+        return [];
+    try {
+        return provider.children(canonicalPath);
+    }
+    catch {
+        // Completion is optional UI metadata and must never block execution.
+        return [];
+    }
+}
+function descriptionsFor(runtime, root, owner) {
+    const state = commandTreeStateFor(runtime);
+    const normalized = root.trim().toLowerCase();
+    if (owner !== undefined && state.owners.get(normalized) !== owner)
+        return undefined;
+    return state.providers.get(normalized)?.descriptions;
+}
+export function getHostCommandTrees(runtime) {
+    if (runtime === undefined)
+        return undefined;
+    try {
+        return commandTreeStateFor(runtime).host;
+    }
+    catch {
+        return undefined;
     }
 }
 export default TuiCommandTreeRuntime;

package/lib/types/dsh-adapter/component-identity.d.ts

@@ -25,4 +25,9 @@ export declare function declaresPermission(identity: VerifiedComponentIdentity,
 export declare function declaresCommand(identity: VerifiedComponentIdentity, commandId: string): boolean;
 export declare function declaresObserverScope(identity: VerifiedComponentIdentity, actualScope: string): boolean;
 export declare function requiresDecisionEvents(identity: VerifiedComponentIdentity): boolean;
+/** Whether admission negotiated the protocol that backs a mediated runtime
+ * capability.  Permissions alone are not a capability grant: a plugin must
+ * explicitly require the corresponding contract before the host can expose
+ * its calls. */
+export declare function requiresContract(identity: VerifiedComponentIdentity, apiVersion: string, kind: string): boolean;
 //# sourceMappingURL=component-identity.d.ts.map

package/lib/types/dsh-adapter/component-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"component-identity.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/component-identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAGxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAG1E,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAAG,4BAA4B,CAAA;AAEhG,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAIvE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC;AAED;;oDAEoD;AACpD,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAyB3C,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,iBAAiB,EAC7B,YAAY,GAAE,MAAqB,GAClC,yBAAyB,CA2B3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAM3F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,CASpF;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAQT;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/F;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvG;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAGnF"}
+{"version":3,"file":"component-identity.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/component-identity.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAGxE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAI1E,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAAG,4BAA4B,CAAA;AAEhG,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAIvE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;CACvC;AAED;;oDAEoD;AACpD,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAqB3C,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,iBAAiB,EAC7B,YAAY,GAAE,MAAqB,GAClC,yBAAyB,CAyB3B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAM3F;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,CASpF;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAQT;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE/F;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAUvG;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAEnF;AAED;;;gBAGgB;AAChB,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAGT"}

package/lib/types/dsh-adapter/component-identity.js

@@ -1,6 +1,7 @@
 /** Verified Component identity bound to one Cordis activation owner. */
 import { randomUUID } from 'node:crypto';
 import { normalizePermissionScope, scopeCovers } from '../plugin-spec/permission-scope.js';
+import { activationFiber, bindCallerEffect } from './host-access.js';
 export class ComponentIdentityError extends Error {
     code;
     constructor(code, message) {
@@ -22,14 +23,9 @@ function validateActivationId(value) {
 }
 const identities = new WeakMap();
 function ownerKey(context) {
-    try {
-        const fiber = context.fiber;
-        if (typeof fiber === 'object' && fiber !== null)
-            return fiber;
-    }
-    catch {
-        // A real plugin context always has a fiber; reject degraded callers below.
-    }
+    const fiber = activationFiber(context);
+    if (fiber !== undefined)
+        return fiber;
     throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', 'a Component activation requires an owning Cordis fiber');
 }
 export function bindComponentIdentity(context, manifest, projection, activationId = randomUUID()) {
@@ -50,12 +46,9 @@ export function bindComponentIdentity(context, manifest, projection, activationI
         if (identities.get(key) === identity)
             identities.delete(key);
     };
-    try {
-        context.effect(() => release);
-    }
-    catch (error) {
+    if (!bindCallerEffect(context, release)) {
         identities.delete(key);
-        throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', `cannot bind Component identity to an inactive activation: ${error instanceof Error ? error.message : String(error)}`);
+        throw new ComponentIdentityError('COMPONENT_NOT_ADMITTED', 'cannot bind Component identity to an inactive activation');
     }
     return identity;
 }
@@ -104,5 +97,12 @@ export function declaresObserverScope(identity, actualScope) {
     });
 }
 export function requiresDecisionEvents(identity) {
-    return identity.manifest.requires.contracts.some(requirement => requirement.apiVersion === 'tui.dsh/v1alpha1' && requirement.kind === 'DecisionEvents');
+    return requiresContract(identity, 'tui.dsh/v1alpha1', 'DecisionEvents');
+}
+/** Whether admission negotiated the protocol that backs a mediated runtime
+ * capability.  Permissions alone are not a capability grant: a plugin must
+ * explicitly require the corresponding contract before the host can expose
+ * its calls. */
+export function requiresContract(identity, apiVersion, kind) {
+    return identity.manifest.requires.contracts.some(requirement => requirement.apiVersion === apiVersion && requirement.kind === kind);
 }

package/lib/types/dsh-adapter/decision-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/decision-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EACL,qBAAqB,EAGrB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAQhC;;qDAEqD;AACrD,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKvE,CAAA;AAMD,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,UAAU,CAAA;AAExC,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAA4B,CAAA;AAEjF,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAA2B,CAAA;AAgB/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAGD;;;cAGc;AACd,MAAM,WAAW,2BAA2B;IAC1C;kFAC8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;sEACkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAA;CAC9D;AAsBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEjE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,SAAS,yBAAyB,EAAE,CA6BtC;AAsCD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,yBAAyB,EACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,MAAM,OAAO,CA4Ff;AAkBD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9E;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,uBAAuB,GAAG,SAAS,CAEjG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+D3E"}
+{"version":3,"file":"decision-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/decision-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EACL,qBAAqB,EAGrB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAShC;;qDAEqD;AACrD,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKtE,CAAA;AAMF,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,UAAU,CAAA;AAExC,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAA4B,CAAA;AAEjF,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAA2B,CAAA;AAgB/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAGD;;;cAGc;AACd,MAAM,WAAW,2BAA2B;IAC1C;kFAC8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;sEACkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAA;CAC9D;AAoBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEjE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,SAAS,yBAAyB,EAAE,CA6BtC;AAsCD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,yBAAyB,EACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,MAAM,OAAO,CA8Ff;AAkBD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9E;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,uBAAuB,GAAG,SAAS,CAEjG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+D3E"}

package/lib/types/dsh-adapter/decision-guard.js

@@ -30,15 +30,16 @@ import { EXTENSION_GRANTS_FILE, parseGrantStore, readGrantStore, } from './grant
 import { componentIdentityOf, requiresDecisionEvents, } from './component-identity.js';
 import { INTERCEPT_EVENT_SCOPE_BY_PERMISSION, normalizePermissionScope, permissionScopeCovers, } from '../plugin-spec/permission-scope.js';
 import { TUI_DECISION_EVENT_NAMES } from '../plugin-spec/tui-extension.js';
+import { bindCallerEffect, compositionRoot } from './host-access.js';
 /** The intercept permission each decision event requires (D-7 naming:
  *  `domain.resource.intercept`). Observe-class events (tui/rewind-done,
  *  tui/session-switched) are deliberately absent. */
-export const DECISION_EVENT_PERMISSIONS = {
+export const DECISION_EVENT_PERMISSIONS = Object.freeze({
     'tui/input': 'session.input.intercept',
     'tui/rewind-prompt': 'session.rewind.intercept',
     'tui/session-switch': 'session.switch.intercept',
     'tui/compact': 'session.compact.intercept',
-};
+});
 // ── Compatibility aliases (pre-GrantStore names) ────────────────────────────
 // The grant-file format and these entry points predate the unified store;
 // keep them working — verify batteries and any embedder code import them
@@ -65,10 +66,7 @@ const guardedRoots = new WeakSet();
 const handlerMetadata = new WeakMap();
 const registries = new WeakMap();
 function rootKey(ctx) {
-    const root = ctx.root;
-    if (typeof root === 'object' && root !== null)
-        return root;
-    return ctx;
+    return compositionRoot(ctx);
 }
 function registryFor(ctx, grants) {
     const key = rootKey(ctx);
@@ -244,11 +242,10 @@ export function registerDecisionHandler(pluginCtx, identity, event, listener, op
         }
         return true;
     };
-    // Both deactivation and grant-file revocation are release boundaries.
-    try {
-        pluginCtx.effect(() => release);
-    }
-    catch { /* degraded test context */ }
+    // Both deactivation and grant-file revocation are release boundaries. Bind
+    // through the host-captured Fiber effect so an explicit Context shadow
+    // cannot replace the cleanup function.
+    bindCallerEffect(pluginCtx, release);
     if (permission !== undefined) {
         const stop = registry.grants.onChange?.(() => {
             const principal = { componentId: identity.componentId, activationId: identity.activationId };
@@ -257,10 +254,7 @@ export function registerDecisionHandler(pluginCtx, identity, event, listener, op
         });
         stopGrantWatch = stop;
         if (stop !== undefined) {
-            try {
-                pluginCtx.effect(() => stop);
-            }
-            catch { /* degraded test context */ }
+            bindCallerEffect(pluginCtx, stop);
         }
     }
     return release;
@@ -295,7 +289,7 @@ export function installDecisionGuard(ctx, grants) {
     // `root` or `on` entirely — the gate is best-effort there, matching the
     // channel's soft-degradation posture: no dedup bookkeeping without a root
     // object, no hook without an `on`.
-    const root = ctx.root ?? ctx;
+    const root = compositionRoot(ctx);
     // Keep the live grant source even when another row installed the Cordis
     // hook first.  The file-backed GrantStore evaluates each operation again.
     registryFor(ctx, grants);

package/lib/types/dsh-adapter/dialogs.d.ts

@@ -89,7 +89,7 @@ export declare class TuiDialogStore {
     private readonly queue;
     private active;
     /** Park a request. The snapshot argument must already be sanitized. */
-    ask(snapshot: WithoutKey<TuiDialogSnapshot>, signal?: AbortSignal, timeoutMs?: number, owner?: Context): Promise<TuiDialogAnswer>;
+    ask(snapshot: WithoutKey<TuiDialogSnapshot>, signal?: AbortSignal, timeoutMs?: number, owner?: Context, bindOwnerEffect?: (disposer: () => unknown, onRegistered: (cleanup: () => unknown) => void) => boolean): Promise<TuiDialogAnswer>;
     /** The dialog the UI should render right now, if any. */
     getSnapshot(): TuiDialogSnapshot | null;
     /**
@@ -124,8 +124,6 @@ declare module '@deepseek-ai/cordis' {
  * down; callers get a logger warning instead.
  */
 export declare class TuiDialogRuntime extends Service {
-    /** The queue the chat screen renders. Exposed for the host, not plugins. */
-    readonly store: TuiDialogStore;
     constructor(ctx: Context);
     /** Cordis traceable services normally provide the caller through `this.ctx`;
      * the explicit overloads below make ownership unambiguous for embedders and
@@ -142,5 +140,6 @@ export declare class TuiDialogRuntime extends Service {
     input(request: TuiDialogInputRequest): Promise<string | undefined>;
     input(owner: Context, request: TuiDialogInputRequest): Promise<string | undefined>;
 }
+export declare function getHostDialogStore(runtime: TuiDialogRuntime | undefined): TuiDialogStore | undefined;
 export default TuiDialogRuntime;
 //# sourceMappingURL=dialogs.d.ts.map

package/lib/types/dsh-adapter/dialogs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialogs.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/dialogs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGtD,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAEL,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;wDACoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;sDACsD;AACtD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;AAc1D;yEACyE;AACzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;AAW/D;;sBAEsB;AACtB,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAI/C;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAA6B;IAE3C,uEAAuE;IACvE,GAAG,CACD,QAAQ,EAAE,UAAU,CAAC,iBAAiB,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,OAAO,GACd,OAAO,CAAC,eAAe,CAAC;IA6D3B,yDAAyD;IACzD,WAAW,IAAI,iBAAiB,GAAG,IAAI;IAIvC;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQjD;sEACkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB,2EAA2E;IAC3E,SAAS,IAAI,IAAI;IASjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,IAAI;CAGb;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,UAAU,EAAE,gBAAgB,CAAA;KAC7B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,OAAO;IAC3C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,iBAAuB;gBAEzB,GAAG,EAAE,OAAO;IAKxB;;0DAEsD;IACtD,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,SAAS;IAMjB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA4BpF,8DAA8D;IAC9D,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B3E,kEAAkE;IAClE,KAAK,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAClE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAoBnF;AAED,eAAe,gBAAgB,CAAA"}
+{"version":3,"file":"dialogs.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/dialogs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAItD,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAEL,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;wDACoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;sDACsD;AACtD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;AAc1D;yEACyE;AACzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;AAW/D;;sBAEsB;AACtB,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAI/C;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAA6B;IAE3C,uEAAuE;IACvE,GAAG,CACD,QAAQ,EAAE,UAAU,CAAC,iBAAiB,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,OAAO,EACf,eAAe,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,OAAO,EACvB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,KAC3C,OAAO,GACX,OAAO,CAAC,eAAe,CAAC;IA+D3B,yDAAyD;IACzD,WAAW,IAAI,iBAAiB,GAAG,IAAI;IAIvC;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQjD;sEACkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB,2EAA2E;IAC3E,SAAS,IAAI,IAAI;IASjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,IAAI;CAGb;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,UAAU,EAAE,gBAAgB,CAAA;KAC7B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,OAAO;gBAC/B,GAAG,EAAE,OAAO;IAYxB;;0DAEsD;IACtD,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,SAAS;IAMjB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuCpF,8DAA8D;IAC9D,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC3E,kEAAkE;IAClE,KAAK,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAClE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA0BnF;AAeD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAOpG;AAED,eAAe,gBAAgB,CAAA"}

package/lib/types/dsh-adapter/dialogs.js

@@ -20,6 +20,7 @@
  */
 import { Context, Service } from '@deepseek-ai/cordis';
 import { cleanScalarText } from './sanitize.js';
+import { activationContext, bindCallerEffect, compositionRoot, concreteService, requirePluginCaller } from './host-access.js';
 /** Render-path strings are untrusted: sanitization (control-char stripping,
  *  cell-width caps, scalar-only coercion) lives in ./sanitize.js — the one
  *  implementation of the Track A contract. `clean` drops non-scalars to ''
@@ -45,7 +46,7 @@ export class TuiDialogStore {
     queue = [];
     active = null;
     /** Park a request. The snapshot argument must already be sanitized. */
-    ask(snapshot, signal, timeoutMs, owner) {
+    ask(snapshot, signal, timeoutMs, owner, bindOwnerEffect) {
         if (signal?.aborted)
             return Promise.resolve(undefined);
         return new Promise((resolve) => {
@@ -98,12 +99,10 @@ export class TuiDialogStore {
                 pending.timer = setTimeout(pending.onAbort, timeoutMs);
             }
             if (owner !== undefined) {
-                try {
-                    const disposer = owner.effect(() => pending.onAbort);
-                    pending.ownerCleanup = typeof disposer === 'function' ? disposer : undefined;
-                }
-                catch {
-                    // An inactive activation must never leave an orphan in the queue.
+                const bound = bindOwnerEffect?.(pending.onAbort, cleanup => { pending.ownerCleanup = cleanup; }) ?? false;
+                if (!bound) {
+                    // An inactive or untrusted activation must never leave an orphan in
+                    // the queue. The binder also rolls back partial owner state.
                     pending.onAbort();
                     return;
                 }
@@ -179,17 +178,32 @@ export class TuiDialogStore {
  * down; callers get a logger warning instead.
  */
 export class TuiDialogRuntime extends Service {
-    /** The queue the chat screen renders. Exposed for the host, not plugins. */
-    store = new TuiDialogStore();
     constructor(ctx) {
         super(ctx, 'tuiDialogs');
-        ctx.effect(() => () => this.store.settleAll());
+        compositionRoot(ctx);
+        // Keep queue state off the service object. Cordis invokes public methods
+        // through a caller-bound proxy, so JS `#private` fields are unsuitable
+        // here; the module-local WeakMap preserves both encapsulation and proxy
+        // compatibility.
+        const store = new TuiDialogStore();
+        hostDialogStores.set(this, store);
+        ctx.effect(() => () => store.settleAll());
     }
     /** Cordis traceable services normally provide the caller through `this.ctx`;
      * the explicit overloads below make ownership unambiguous for embedders and
      * tests that retain the service instance directly. */
     callContext(value) {
-        return Context.is(value) ? value : this.ctx;
+        const caller = requirePluginCaller(this.ctx, 'tuiDialogs', this);
+        if (!Context.is(value))
+            return caller;
+        // An explicit owner is accepted only when it is the activation that made
+        // the service call.  Otherwise a plugin could pass the root (or another
+        // plugin's context) and leave an orphaned dialog alive after deactivation.
+        const canonical = activationContext(value);
+        if (canonical === undefined || activationContext(caller) !== canonical) {
+            throw new Error('tuiDialogs owner context must be the calling activation');
+        }
+        return canonical;
     }
     timeoutOf(value) {
         return typeof value === 'number' && Number.isFinite(value) && value > 0
@@ -197,66 +211,106 @@ export class TuiDialogRuntime extends Service {
             : DIALOG_DEFAULT_TIMEOUT_MS;
     }
     select(ownerOrRequest, explicitRequest) {
-        const owner = this.callContext(ownerOrRequest);
-        const request = (explicitRequest ?? ownerOrRequest);
-        const title = clean(request?.title, TITLE_CELLS);
-        const rawOptions = Array.isArray(request?.options) ? request.options : [];
-        const options = [];
-        for (const raw of rawOptions.slice(0, MAX_OPTIONS)) {
-            // The id is NOT render-path data — it is the opaque token the promise
-            // resolves with, matched by the plugin against its own options. Sanitizing
-            // it (whitespace collapse, cell truncation) would hand back a DIFFERENT
-            // string the plugin cannot look up; validate and keep it verbatim.
-            const id = raw?.id;
-            const label = clean(raw?.label, LABEL_CELLS);
-            if (typeof id !== 'string' || id === '' || !label)
-                continue;
-            // '' (absent, blank, or a dropped non-scalar) means no description row.
-            const description = clean(raw?.description, MESSAGE_CELLS);
-            options.push({ id, label, ...(description === '' ? {} : { description }) });
+        try {
+            const owner = this.callContext(ownerOrRequest);
+            const request = (explicitRequest ?? ownerOrRequest);
+            const title = clean(request?.title, TITLE_CELLS);
+            const rawOptions = Array.isArray(request?.options) ? request.options : [];
+            const options = [];
+            for (const raw of rawOptions.slice(0, MAX_OPTIONS)) {
+                // The id is NOT render-path data — it is the opaque token the promise
+                // resolves with, matched by the plugin against its own options. Sanitizing
+                // it (whitespace collapse, cell truncation) would hand back a DIFFERENT
+                // string the plugin cannot look up; validate and keep it verbatim.
+                const id = raw?.id;
+                const label = clean(raw?.label, LABEL_CELLS);
+                if (typeof id !== 'string' || id === '' || !label)
+                    continue;
+                // '' (absent, blank, or a dropped non-scalar) means no description row.
+                const description = clean(raw?.description, MESSAGE_CELLS);
+                options.push({ id, label, ...(description === '' ? {} : { description }) });
+            }
+            if (!title || options.length === 0) {
+                this.ctx.logger.warn('dsh-tui: tuiDialogs.select called without a title or options; cancelled');
+                return Promise.resolve(undefined);
+            }
+            return dialogStoreFor(this)
+                .ask({ kind: 'select', title, options }, request.signal, this.timeoutOf(request.timeoutMs), owner, (disposer, onRegistered) => bindCallerEffect(owner, disposer, onRegistered))
+                .then(value => (typeof value === 'string' ? value : undefined));
         }
-        if (!title || options.length === 0) {
-            this.ctx.logger.warn('dsh-tui: tuiDialogs.select called without a title or options; cancelled');
+        catch {
+            this.ctx.logger.warn('dsh-tui: tuiDialogs.select received malformed data; cancelled');
             return Promise.resolve(undefined);
         }
-        return this.store
-            .ask({ kind: 'select', title, options }, request.signal, this.timeoutOf(request.timeoutMs), owner)
-            .then(value => (typeof value === 'string' ? value : undefined));
     }
     confirm(ownerOrRequest, explicitRequest) {
-        const owner = this.callContext(ownerOrRequest);
-        const request = (explicitRequest ?? ownerOrRequest);
-        const title = clean(request?.title, TITLE_CELLS);
-        if (!title) {
-            this.ctx.logger.warn('dsh-tui: tuiDialogs.confirm called without a title; cancelled');
+        try {
+            const owner = this.callContext(ownerOrRequest);
+            const request = (explicitRequest ?? ownerOrRequest);
+            const title = clean(request?.title, TITLE_CELLS);
+            if (!title) {
+                this.ctx.logger.warn('dsh-tui: tuiDialogs.confirm called without a title; cancelled');
+                return Promise.resolve(false);
+            }
+            const message = clean(request?.message, MESSAGE_CELLS);
+            const confirmLabel = clean(request?.confirmLabel, LABEL_CELLS);
+            const cancelLabel = clean(request?.cancelLabel, LABEL_CELLS);
+            return dialogStoreFor(this)
+                .ask({
+                kind: 'confirm',
+                title,
+                ...(message === '' ? {} : { message }),
+                confirmLabel,
+                cancelLabel,
+            }, request.signal, this.timeoutOf(request.timeoutMs), owner, (disposer, onRegistered) => bindCallerEffect(owner, disposer, onRegistered))
+                .then(value => value === true);
+        }
+        catch {
+            this.ctx.logger.warn('dsh-tui: tuiDialogs.confirm received malformed data; cancelled');
             return Promise.resolve(false);
         }
-        const message = clean(request?.message, MESSAGE_CELLS);
-        const confirmLabel = clean(request?.confirmLabel, LABEL_CELLS);
-        const cancelLabel = clean(request?.cancelLabel, LABEL_CELLS);
-        return this.store
-            .ask({
-            kind: 'confirm',
-            title,
-            ...(message === '' ? {} : { message }),
-            confirmLabel,
-            cancelLabel,
-        }, request.signal, this.timeoutOf(request.timeoutMs), owner)
-            .then(value => value === true);
     }
     input(ownerOrRequest, explicitRequest) {
-        const owner = this.callContext(ownerOrRequest);
-        const request = (explicitRequest ?? ownerOrRequest);
-        const title = clean(request?.title, TITLE_CELLS);
-        if (!title) {
-            this.ctx.logger.warn('dsh-tui: tuiDialogs.input called without a title; cancelled');
+        try {
+            const owner = this.callContext(ownerOrRequest);
+            const request = (explicitRequest ?? ownerOrRequest);
+            const title = clean(request?.title, TITLE_CELLS);
+            if (!title) {
+                this.ctx.logger.warn('dsh-tui: tuiDialogs.input called without a title; cancelled');
+                return Promise.resolve(undefined);
+            }
+            const placeholder = clean(request?.placeholder, LABEL_CELLS);
+            const initial = clean(request?.initial, INPUT_CELLS);
+            return dialogStoreFor(this)
+                .ask({ kind: 'input', title, ...(placeholder === '' ? {} : { placeholder }), initial }, request.signal, this.timeoutOf(request.timeoutMs), owner, (disposer, onRegistered) => bindCallerEffect(owner, disposer, onRegistered))
+                .then(value => (typeof value === 'string' ? value : undefined));
+        }
+        catch {
+            this.ctx.logger.warn('dsh-tui: tuiDialogs.input received malformed data; cancelled');
             return Promise.resolve(undefined);
         }
-        const placeholder = clean(request?.placeholder, LABEL_CELLS);
-        const initial = clean(request?.initial, INPUT_CELLS);
-        return this.store
-            .ask({ kind: 'input', title, ...(placeholder === '' ? {} : { placeholder }), initial }, request.signal, this.timeoutOf(request.timeoutMs), owner)
-            .then(value => (typeof value === 'string' ? value : undefined));
+    }
+}
+/**
+ * Host-only queue accessor. This module is intentionally not a package
+ * export; plugins receive only the traceable `tuiDialogs` capability, whose
+ * public surface is select/confirm/input.
+ */
+const hostDialogStores = new WeakMap();
+function dialogStoreFor(runtime) {
+    const store = hostDialogStores.get(concreteService(runtime));
+    if (store === undefined)
+        throw new Error('tuiDialogs host store is unavailable');
+    return store;
+}
+export function getHostDialogStore(runtime) {
+    if (runtime === undefined)
+        return undefined;
+    try {
+        return hostDialogStores.get(concreteService(runtime));
+    }
+    catch {
+        return undefined;
     }
 }
 export default TuiDialogRuntime;

package/lib/types/dsh-adapter/effect-ledger.d.ts

@@ -66,14 +66,6 @@ declare module '@deepseek-ai/cordis' {
 }
 /** `ctx.tuiEffectLedger` — append-only effect journal (C-060). */
 export declare class TuiEffectLedgerRuntime extends Service {
-    private readonly file;
-    private readonly optionsGenerationId;
-    private generationId;
-    private readonly ledgerSchema;
-    private readonly activations;
-    private nextActivation;
-    private sequence;
-    private schemaWarned;
     constructor(ctx: Context, options?: {
         file?: string;
         generationId?: string;

package/lib/types/dsh-adapter/effect-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"effect-ledger.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/effect-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMtD,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,QAAwC,CAAA;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,oHASxB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAA;AAC1F,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,MAAM,EAAE,YAAY,CAAA;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,sBAAsB,CAAA;KACxC;CACF;AAWD,kEAAkE;AAClE,qBAAa,sBAAuB,SAAQ,OAAO;IACjD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IACxD,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,YAAY,CAAQ;gBAG1B,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAO;IAehG;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI;IA2DpD;;yCAEqC;IACrC,OAAO,CAAC,UAAU;IAMlB,gFAAgF;IAChF,OAAO,CAAC,cAAc;IAsBtB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,YAAY;CAYrB;AAED,eAAe,sBAAsB,CAAA"}
+{"version":3,"file":"effect-ledger.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/effect-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAOtD,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,QAAwC,CAAA;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,oHASxB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAA;AAC1F,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,MAAM,EAAE,YAAY,CAAA;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,sBAAsB,CAAA;KACxC;CACF;AAWD,kEAAkE;AAClE,qBAAa,sBAAuB,SAAQ,OAAO;gBAE/C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAO;IA0BhG;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI;IA6DpD;;yCAEqC;IACrC,OAAO,CAAC,UAAU;IAOlB,gFAAgF;IAChF,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,YAAY;CAarB;AA6CD,eAAe,sBAAsB,CAAA"}