@deepseek-harness-tui/dsh-tui 0.8.1 → 0.8.2

package/lib/types/dsh-adapter/effect-ledger.js

@@ -41,6 +41,7 @@ import { DATA_DIR } from '../utils/paths.js';
 import { loadSpecData } from '../plugin-spec/registry.js';
 import { check } from '../plugin-spec/schema-check.js';
 import { componentIdentityOf } from './component-identity.js';
+import { compositionRoot, concreteService } from './host-access.js';
 /** Default ledger file (JSONL, one record per line). */
 export const EFFECT_LEDGER_FILE = join(DATA_DIR, 'effect-ledger.jsonl');
 /** Resource kinds recorded by the host's wired emitters. */
@@ -65,26 +66,29 @@ function cleanField(value, max, fallback) {
 }
 /** `ctx.tuiEffectLedger` — append-only effect journal (C-060). */
 export class TuiEffectLedgerRuntime extends Service {
-    file;
-    optionsGenerationId;
-    generationId;
-    ledgerSchema;
-    activations = new WeakMap();
-    nextActivation = 1;
-    sequence;
-    schemaWarned = false;
     constructor(ctx, options = {}) {
         super(ctx, 'tuiEffectLedger');
-        this.file = options.file ?? EFFECT_LEDGER_FILE;
+        const file = options.file ?? EFFECT_LEDGER_FILE;
         // The generation is resolved LAZILY (per first record): cordis does not
         // make sibling services visible to constructors of plugins mounted later
         // by the same apply(), so a constructor-time probe would always miss the
         // plugin-host service and fall back to 'unknown-generation'.
-        this.optionsGenerationId = options.generationId;
+        const state = {
+            hostContext: compositionRoot(ctx),
+            file,
+            optionsGenerationId: options.generationId,
+            generationId: undefined,
+            activations: new WeakMap(),
+            nextActivation: 1,
+            sequence: 0,
+            schemaWarned: false,
+            ledgerSchema: undefined,
+        };
         // `'ledgerSchema' in options` lets a caller force-undefined (fail-closed
         // test seam), same contract as the message observer's envelopeSchema.
-        this.ledgerSchema = 'ledgerSchema' in options ? options.ledgerSchema : loadSpecData()?.schemas.ledger;
-        this.sequence = this.resumeSequence();
+        state.ledgerSchema = 'ledgerSchema' in options ? options.ledgerSchema : loadSpecData()?.schemas.ledger;
+        state.sequence = resumeSequence(file);
+        ledgerStates.set(this, state);
     }
     /**
      * Append one record. `identity` is the caller's own context (plugins pass
@@ -92,11 +96,13 @@ export class TuiEffectLedgerRuntime extends Service {
      * parameter); omitting it records `undeclared`, never a guess.
      */
     record(entry, identity) {
+        let state;
         try {
-            if (this.ledgerSchema === undefined) {
-                if (!this.schemaWarned) {
-                    this.schemaWarned = true;
-                    this.ctx.logger.warn('dsh-tui: effect ledger schema unavailable — suppressing all ledger writes (fail-closed)');
+            state = ledgerStateFor(this);
+            if (state.ledgerSchema === undefined) {
+                if (!state.schemaWarned) {
+                    state.schemaWarned = true;
+                    state.hostContext.logger.warn('dsh-tui: effect ledger schema unavailable — suppressing all ledger writes (fail-closed)');
                 }
                 return;
             }
@@ -105,7 +111,7 @@ export class TuiEffectLedgerRuntime extends Service {
             const pluginId = this.pluginIdOf(identity, fiber, verified?.componentId);
             const record = {
                 ledgerVersion: '0.15',
-                sequence: this.sequence,
+                sequence: state.sequence,
                 timestamp: new Date().toISOString(),
                 pluginId,
                 activationInstance: verified?.activationId ?? this.activationOf(fiber, pluginId),
@@ -135,54 +141,34 @@ export class TuiEffectLedgerRuntime extends Service {
             // schema is DROPPED, not written (the schema's additionalProperties:
             // false is the structural secret ban).
             try {
-                check(record, this.ledgerSchema, this.ledgerSchema);
+                check(record, state.ledgerSchema, state.ledgerSchema);
             }
             catch (error) {
-                this.ctx.logger.warn(`dsh-tui: effect ledger record dropped (schema: ${error instanceof Error ? error.message : String(error)})`);
+                state.hostContext.logger.warn(`dsh-tui: effect ledger record dropped (schema: ${error instanceof Error ? error.message : String(error)})`);
                 return;
             }
-            mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
-            appendFileSync(this.file, `${JSON.stringify(record)}\n`, { mode: 0o600 });
-            this.sequence += 1;
+            mkdirSync(dirname(state.file), { recursive: true, mode: 0o700 });
+            appendFileSync(state.file, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+            state.sequence += 1;
         }
         catch (error) {
-            this.ctx.logger.warn(`dsh-tui: effect ledger write failed: %o`, error);
+            ;
+            (state?.hostContext ?? this.ctx).logger.warn('dsh-tui: effect ledger write failed');
         }
     }
     /** Runtime generation (C-050): options override, else the plugin-host
      *  service's id — resolved on first record and cached (the host row mounts
      *  before any caller can record). */
     generation() {
-        if (this.optionsGenerationId !== undefined)
-            return this.optionsGenerationId;
-        this.generationId ??= this.ctx.get('tuiPluginHost')?.generationId ?? 'unknown-generation';
-        return this.generationId;
+        const state = ledgerStateFor(this);
+        if (state.optionsGenerationId !== undefined)
+            return state.optionsGenerationId;
+        state.generationId ??= state.hostContext.get('tuiPluginHost')?.generationId ?? 'unknown-generation';
+        return state.generationId;
     }
     /** Continue numbering after the existing file's max sequence (restart-safe). */
     resumeSequence() {
-        let text;
-        try {
-            text = readFileSync(this.file, 'utf8');
-        }
-        catch {
-            return 0; // missing file = fresh ledger, not corruption
-        }
-        let max = -1;
-        for (const line of text.split('\n')) {
-            if (line.trim() === '')
-                continue;
-            try {
-                const parsed = JSON.parse(line);
-                const sequence = parsed.sequence;
-                if (typeof sequence === 'number' && Number.isInteger(sequence) && sequence > max)
-                    max = sequence;
-            }
-            catch {
-                // Corrupt line: skip it (never rewritten — the bytes stay for manual
-                // recovery, same posture as plugin-storage).
-            }
-        }
-        return max + 1;
+        return resumeSequence(ledgerStateFor(this).file);
     }
     fiberOf(identity) {
         if (identity === undefined)
@@ -220,12 +206,46 @@ export class TuiEffectLedgerRuntime extends Service {
         // is exact; per-fiber ids only matter for plugin fibers.
         if (fiber === undefined || pluginId === 'host' || pluginId === 'undeclared')
             return pluginId;
-        let activation = this.activations.get(fiber);
+        const state = ledgerStateFor(this);
+        let activation = state.activations.get(fiber);
         if (activation === undefined) {
-            activation = `activation-${this.nextActivation++}`;
-            this.activations.set(fiber, activation);
+            activation = `activation-${state.nextActivation++}`;
+            state.activations.set(fiber, activation);
         }
         return activation;
     }
 }
+const ledgerStates = new WeakMap();
+function ledgerStateFor(runtime) {
+    const state = ledgerStates.get(concreteService(runtime));
+    if (state === undefined)
+        throw new Error('tuiEffectLedger host state is unavailable');
+    return state;
+}
+/** Continue numbering after the existing file's max sequence (restart-safe). */
+function resumeSequence(file) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch {
+        return 0; // missing file = fresh ledger, not corruption
+    }
+    let max = -1;
+    for (const line of text.split('\n')) {
+        if (line.trim() === '')
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const sequence = parsed.sequence;
+            if (typeof sequence === 'number' && Number.isInteger(sequence) && sequence > max)
+                max = sequence;
+        }
+        catch {
+            // Corrupt line: skip it (never rewritten — the bytes stay for manual
+            // recovery, same posture as plugin-storage).
+        }
+    }
+    return max + 1;
+}
 export default TuiEffectLedgerRuntime;

package/lib/types/dsh-adapter/extension-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension-events.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extension-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAYlD;;wEAEwE;AACxE,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAC/C,eAAO,MAAM,yBAAyB,OAAO,CAAA;AA4C7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,SAAS,GAC1E,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CA4DxB;AAED;uEACuE;AACvE,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;kDAGkD;AAClD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQ/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB;AAC1B,6DAA6D;AAC3D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB;+EAC+E;GAC7E;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACpC,kEAAkE;GAChE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC,gDAAgD;GAC9C,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,uBAAuB;AACjC,2EAA2E;AACzE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC;0DAC0D;GACxD;IAAE,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE;AACrC,oEAAoE;GAClE,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ;oCACgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,wBAAwB;AAClC;4BAC4B;AAC1B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACjC,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;CAAG;AAE9D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC/E,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC5G,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QAC9F,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAChH,sBAAsB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5E,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KACxF;CACF"}
+{"version":3,"file":"extension-events.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extension-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAYlD;;wEAEwE;AACxE,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAC/C,eAAO,MAAM,yBAAyB,OAAO,CAAA;AA4C7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,SAAS,GAC1E,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CA4DxB;AAED;uEACuE;AACvE,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;kDAGkD;AAClD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQ/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB;AAC1B,6DAA6D;AAC3D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB;+EAC+E;GAC7E;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACpC,kEAAkE;GAChE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC,gDAAgD;GAC9C,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,uBAAuB;AACjC,2EAA2E;AACzE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC;0DAC0D;GACxD;IAAE,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE;AACrC,oEAAoE;GAClE,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ;oCACgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,wBAAwB;AAClC;4BAC4B;AAC1B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACjC,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;CAAG;AAE9D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC/E,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC5G,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QAC9F,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAChH,sBAAsB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5E,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KACxF;CACF"}

package/lib/types/dsh-adapter/extension-events.js

@@ -151,7 +151,45 @@ export async function dispatchTuiDecision(ctx, name, payload, normalize) {
 /** Fire a non-veto DecisionEvents point with the same bounded, isolated
  * semantics.  Notifications deliberately ignore every return value. */
 export async function dispatchTuiNotification(ctx, name, payload) {
-    await dispatchTuiDecision(ctx, name, payload, () => undefined);
+    const sessionId = typeof payload.sessionId === 'string' ? payload.sessionId : undefined;
+    const scope = sessionId === undefined ? undefined : `session:${sessionId}`;
+    const listeners = decisionHandlersOf(ctx, name, scope);
+    const log = (message, error) => {
+        try {
+            if (error === undefined)
+                ctx.logger.warn(message);
+            else
+                ctx.logger.warn(message, error);
+        }
+        catch {
+            // Degraded ctx without a logger: warnings are best-effort.
+        }
+    };
+    const started = Date.now();
+    // Notifications have no return-value or ordering semantics. Start every
+    // listener from the same snapshot so one slow plugin cannot delay another
+    // plugin's session rebind (or make a fire-and-forget dispatch look stuck).
+    await Promise.all(listeners.map(async (handler) => {
+        const permission = DECISION_EVENT_PERMISSIONS[name];
+        const principal = { componentId: handler.componentId, activationId: handler.activationId };
+        if (permission !== undefined
+            && !decisionRegistryOf(ctx).grants.allows(principal, permission, scope ?? handler.scope)) {
+            log(`dsh-tui: ${name} handler from Component "${handler.componentId}" skipped after grant revocation`);
+            return;
+        }
+        const remaining = DECISION_TOTAL_TIMEOUT_MS - (Date.now() - started);
+        if (remaining <= 0) {
+            log(`dsh-tui: ${name} total decision budget exceeded; handler skipped`);
+            return;
+        }
+        const bounded = await runBounded(() => handler.listener(freezeClone(payload)), Math.min(DECISION_HANDLER_TIMEOUT_MS, remaining));
+        if (bounded.kind === 'timeout') {
+            log(`dsh-tui: ${name} handler from Component "${handler.componentId}" exceeded ${DECISION_HANDLER_TIMEOUT_MS}ms; continuing`);
+        }
+        else if (bounded.kind === 'error') {
+            log(`dsh-tui: ${name} listener failed; continuing with the other listeners: %o`, bounded.error);
+        }
+    }));
 }
 /** Shared normalizer for the veto-only decisions (session-switch, compact):
  *  `{ cancel: true, reason? }` or no opinion; everything else is ignored.

package/lib/types/dsh-adapter/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/grants.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAI5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAKjE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAE5D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,cAAc,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtF,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC/C,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAkID,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAiB,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAgDhG"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/grants.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAI5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAKjE,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAE5D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,cAAc,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtF,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC/C,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAkJD,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAiB,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,UAAU,CA0DhG"}

package/lib/types/dsh-adapter/grants.js

@@ -1,5 +1,5 @@
 /** Live, scoped plugin grant evaluation. */
-import { readFileSync, unwatchFile, watchFile } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { normalizePermissionScope, permissionScopeCovers } from '../plugin-spec/permission-scope.js';
 import { loadSpecData } from '../plugin-spec/registry.js';
@@ -34,18 +34,32 @@ function parseTable(text) {
     catch {
         return { grants, denies, corrupt: true };
     }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return { grants, denies, corrupt: true };
+    }
+    const root = parsed;
+    if (Object.keys(root).some(key => key !== 'grants' && key !== 'denies')) {
+        return { grants, denies, corrupt: true };
+    }
     const readSection = (key, target) => {
-        const section = parsed?.[key];
+        const section = root[key];
+        if (section === undefined)
+            return true;
         if (section === null || typeof section !== 'object' || Array.isArray(section))
-            return;
+            return false;
         for (const [componentId, values] of Object.entries(section)) {
-            if (!Array.isArray(values))
-                continue;
-            target.set(componentId, values.map(parseRule).filter((rule) => rule !== undefined));
+            if (componentId === '' || !Array.isArray(values))
+                return false;
+            const rules = values.map(parseRule);
+            if (rules.some(rule => rule === undefined))
+                return false;
+            target.set(componentId, rules);
         }
+        return true;
     };
-    readSection('grants', grants);
-    readSection('denies', denies);
+    if (!readSection('grants', grants) || !readSection('denies', denies)) {
+        return { grants: new Map(), denies: new Map(), corrupt: true };
+    }
     return { grants, denies, corrupt: false };
 }
 function resolveRegistry(registry) {
@@ -91,7 +105,11 @@ function hasUnknownActivationRule(rules, principal, permission, scope) {
 }
 function storeFrom(table, registry, onChange) {
     const known = new Map((registry?.permissions ?? []).map(entry => [entry.name, entry.default]));
-    return {
+    // The store is a capability, not a mutable configuration object.  Keep the
+    // live table in the closure and freeze the facade so a traceable Cordis
+    // proxy (or an accidentally retained reference) cannot replace `allows`
+    // and turn an authorization check into an unconditional allow.
+    return Object.freeze({
         get corrupt() {
             return table().corrupt;
         },
@@ -116,7 +134,7 @@ function storeFrom(table, registry, onChange) {
         defaultOf: permission => known.get(permission) ?? 'deny',
         knownPermissions: () => [...known.keys()],
         onChange,
-    };
+    });
 }
 /** Parse a fixed snapshot, primarily for deterministic tests. */
 export function parseGrantStore(text, registry) {
@@ -134,15 +152,18 @@ export function readGrantStore(dir = DATA_DIR, registry) {
     const file = join(dir, EXTENSION_GRANTS_FILE);
     const readCurrent = () => {
         let text;
+        let missing = false;
         try {
             text = readFileSync(file, 'utf8');
         }
         catch (error) {
-            const missing = error.code === 'ENOENT';
+            missing = error.code === 'ENOENT';
             text = missing ? '' : '{unreadable';
         }
         return {
-            table: text === ''
+            // An existing zero-byte file is corruption, not the same state as an
+            // absent grants file. Only ENOENT receives the registry defaults.
+            table: missing
                 ? { grants: new Map(), denies: new Map(), corrupt: false }
                 : parseTable(text),
             signature: text,
@@ -150,6 +171,7 @@ export function readGrantStore(dir = DATA_DIR, registry) {
     };
     const listeners = new Set();
     let watching = false;
+    let watchTimer;
     let signature = readCurrent().signature;
     const changed = () => {
         const next = readCurrent().signature;
@@ -170,13 +192,20 @@ export function readGrantStore(dir = DATA_DIR, registry) {
         listeners.add(listener);
         if (!watching) {
             watching = true;
-            watchFile(file, { interval: 100, persistent: false }, changed);
+            // A small unref'ed poll is deterministic across filesystems and
+            // timestamp granularities. The synchronous read on every operation
+            // remains the authorization source of truth; this loop only releases
+            // grant-owned subscriptions promptly after a revocation.
+            watchTimer = setInterval(changed, 50);
+            watchTimer.unref?.();
         }
         return () => {
             listeners.delete(listener);
             if (watching && listeners.size === 0) {
                 watching = false;
-                unwatchFile(file, changed);
+                if (watchTimer !== undefined)
+                    clearInterval(watchTimer);
+                watchTimer = undefined;
             }
         };
     };

package/lib/types/dsh-adapter/host-access.d.ts

@@ -0,0 +1,37 @@
+import { Context } from '@deepseek-ai/cordis';
+/** Host-only escape hatch for process teardown paths that intentionally act on
+ * the composition root while running from a host plugin callback. This module
+ * is internal and is not part of the public plugin package surface. */
+export declare function withHostRootCapability<T>(callback: () => T): T;
+export declare function concreteService<T extends object>(service: T): T;
+/** Bind a host-side disposer to the caller's authenticated Cordis activation.
+ * A failed registration immediately rolls back the owned contribution. */
+export declare function bindCallerEffect(ctx: Context, disposer: () => unknown, onRegistered?: (cleanup: () => unknown) => void): boolean;
+/** Return the stable, authenticated Fiber identity for an activation. */
+export declare function activationFiber(ctx: Context): object | undefined;
+/** Return Cordis's canonical activation context, never a writable context
+ * shadow. Explicit owner arguments use this before resolving host services. */
+export declare function activationContext(ctx: Context): Context | undefined;
+/** Resolve a service's composition root once.  Service methods are invoked
+ * through caller-bound Cordis proxies; keeping this root in host state avoids
+ * resolving sibling services through an attacker-provided caller shadow. */
+export declare function compositionRoot(ctx: Context): Context;
+/** Recover the composition root that owns a traceable service. Cordis stores
+ * the provider context on the concrete Service instance; callers may reach
+ * that instance through a proxy from another composition, so this must be
+ * resolved from the unwrapped service rather than from the call context. */
+export declare function serviceCompositionRoot(service: object): Context | undefined;
+/** Explicit context arguments on mediated APIs may be supplied by host code
+ * running from the composition root, or may be the activation making the
+ * service call.  A non-root plugin cannot nominate a different activation's
+ * context and thereby borrow its verified identity/lifecycle. */
+export declare function assertCallerContext(caller: Context, target: Context, capability: string, service?: object): void;
+/**
+ * Resolve the caller for a plugin-owned effect. A plugin can read
+ * `ctx.root`, but using its root-bound service proxy would attach cleanup to
+ * the host fiber and leave the effect alive after the plugin unloads. Host
+ * code must use the module-local host accessor for controls it owns; the
+ * public service surface only accepts a live non-root activation.
+ */
+export declare function requirePluginCaller(caller: Context, capability: string, service?: object): Context;
+//# sourceMappingURL=host-access.d.ts.map

package/lib/types/dsh-adapter/host-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-access.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/host-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAS,MAAM,qBAAqB,CAAA;AAoSpD;;uEAEuE;AACvE,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAE9D;AA8FD,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAe/D;AAED;0EAC0E;AAC1E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,OAAO,EACvB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,GAC9C,OAAO,CA2BT;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMhE;AAED;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAInE;AAED;;4EAE4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAwDrD;AAuDD;;;4EAG4E;AAC5E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAO3E;AAED;;;iEAGiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAehH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAmBlG"}