@deepseek-harness-tui/dsh-tui 0.9.1 → 0.9.3

package/lib/types/update.js

@@ -1,5 +1,5 @@
-import { spawn } from 'node:child_process';
-import { appendFileSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { execFileSync, spawn } from 'node:child_process';
+import { appendFileSync, chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -11,7 +11,9 @@ import { DATA_DIR } from './utils/paths.js';
 export { shellQuote };
 const PACKAGE_NAME = '@deepseek-harness-tui/dsh-tui';
 const DEFAULT_REGISTRY = 'https://registry.npmjs.org';
+const GITHUB_REPO = 'ccch1mneyyy/dsh-TUI';
 const UPDATE_CHECK_TIMEOUT_MS = 4000;
+const STANDALONE_DOWNLOAD_TIMEOUT_MS = 300000;
 /** env marker set on the /update restart; the new process verifies it at boot. */
 const UPDATED_FROM_ENV = 'DSH_TUI_UPDATED_FROM';
 /**
@@ -189,6 +191,189 @@ async function fetchLatestVersion(registryBase) {
         clearTimeout(timeout);
     }
 }
+/**
+ * Detect whether the current process is running in standalone / portable package mode.
+ *
+ * @returns `true` when running inside a standalone binary distribution, `false` otherwise.
+ */
+export function isStandaloneRuntime() {
+    return (process.env.DSH_TUI_STANDALONE === '1' ||
+        process.env.DSH_TUI_STANDALONE_BINARY !== undefined ||
+        (typeof process.env.DSH_HOME === 'string' && process.env.DSH_HOME.includes('dsh-tui-standalone')));
+}
+/**
+ * Get the path to the current standalone executable binary.
+ *
+ * @returns The resolved executable path from environment or `process.execPath`.
+ */
+export function getStandaloneBinaryPath() {
+    return process.env.DSH_TUI_STANDALONE_BINARY ?? process.execPath;
+}
+/**
+ * Get the expected release asset file name for the current platform and architecture.
+ *
+ * @param platform - Node.js platform identifier (e.g. `'linux'`, `'win32'`, `'darwin'`).
+ * @param arch - Node.js architecture identifier (e.g. `'x64'`, `'arm64'`).
+ * @returns The archive file name matching the target platform.
+ */
+export function getStandaloneAssetName(platform = process.platform, arch = process.arch) {
+    if (platform === 'win32') {
+        return 'dsh-tui-standalone-win-x64.zip';
+    }
+    if (platform === 'darwin') {
+        return arch === 'arm64'
+            ? 'dsh-tui-standalone-darwin-arm64.tar.gz'
+            : 'dsh-tui-standalone-darwin-x64.tar.gz';
+    }
+    return arch === 'arm64'
+        ? 'dsh-tui-standalone-linux-arm64.tar.gz'
+        : 'dsh-tui-standalone-linux-x64.tar.gz';
+}
+/**
+ * Fetch latest release info from GitHub Releases API for the standalone asset.
+ *
+ * @returns Release version tag and matching asset download URL, or `undefined` on any failure.
+ */
+export async function fetchGithubLatestRelease() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), UPDATE_CHECK_TIMEOUT_MS);
+    try {
+        const response = await fetch(`https://api.github.com/repos/${GITHUB_REPO}/releases/latest`, {
+            headers: { accept: 'application/vnd.github.v3+json', 'user-agent': 'dsh-tui-updater' },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return undefined;
+        const payload = await response.json();
+        if (!isRecord(payload) || typeof payload.tag_name !== 'string')
+            return undefined;
+        const rawTag = payload.tag_name.replace(/^v/, '');
+        const version = valid(rawTag);
+        if (version === null)
+            return undefined;
+        const assetName = getStandaloneAssetName();
+        let downloadUrl;
+        if (Array.isArray(payload.assets)) {
+            const asset = payload.assets.find((a) => isRecord(a) && a.name === assetName && typeof a.browser_download_url === 'string');
+            if (asset !== undefined && typeof asset.browser_download_url === 'string') {
+                downloadUrl = asset.browser_download_url;
+            }
+        }
+        if (downloadUrl === undefined) {
+            downloadUrl = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${assetName}`;
+        }
+        return { version, downloadUrl };
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Download the new standalone release binary package and atomically replace the running binary.
+ *
+ * @param downloadUrl - Direct URL to download the release archive.
+ * @param onProgress - Optional callback invoked with progress status strings.
+ * @returns Object indicating success or an error message on failure.
+ */
+export async function downloadAndReplaceStandaloneBinary(downloadUrl, onProgress) {
+    const tempDir = join(process.env.DSH_TUI_STANDALONE_CACHE ?? join(homedir(), '.cache', 'dsh-tui-standalone'), `.update-${Date.now()}-${process.pid}`);
+    try {
+        const currentBinary = getStandaloneBinaryPath();
+        const targetDir = dirname(currentBinary);
+        const assetName = getStandaloneAssetName();
+        const isZip = assetName.endsWith('.zip');
+        mkdirSync(tempDir, { recursive: true });
+        const downloadPath = join(tempDir, assetName);
+        onProgress?.(`downloading: ${downloadUrl}`);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), STANDALONE_DOWNLOAD_TIMEOUT_MS);
+        let response;
+        try {
+            response = await fetch(downloadUrl, {
+                headers: { 'user-agent': 'dsh-tui-updater' },
+                redirect: 'follow',
+                signal: controller.signal,
+            });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status} ${response.statusText}`);
+        }
+        const buffer = Buffer.from(await response.arrayBuffer());
+        writeFileSync(downloadPath, buffer);
+        onProgress?.('extracting…');
+        const extractDir = join(tempDir, 'extracted');
+        mkdirSync(extractDir, { recursive: true });
+        if (isZip) {
+            if (process.platform === 'win32') {
+                execFileSync('powershell', [
+                    '-NoProfile', '-Command',
+                    `Expand-Archive -Path '${downloadPath}' -DestinationPath '${extractDir}' -Force`,
+                ]);
+            }
+            else {
+                execFileSync('unzip', ['-o', downloadPath, '-d', extractDir]);
+            }
+        }
+        else {
+            execFileSync('tar', ['-xzf', downloadPath, '-C', extractDir]);
+        }
+        const binaryName = process.platform === 'win32' ? 'dsh-tui.exe' : 'dsh-tui';
+        const newBinaryPath = join(extractDir, binaryName);
+        if (!existsSync(newBinaryPath)) {
+            throw new Error('No executable binary found in release archive');
+        }
+        onProgress?.('replacing binary…');
+        if (process.platform !== 'win32') {
+            try {
+                chmodSync(newBinaryPath, 0o755);
+            }
+            catch { }
+        }
+        if (process.platform === 'win32') {
+            const oldBinary = `${currentBinary}.old`;
+            try {
+                rmSync(oldBinary, { force: true });
+            }
+            catch { }
+            renameSync(currentBinary, oldBinary);
+            try {
+                copyFileSync(newBinaryPath, currentBinary);
+            }
+            catch (copyError) {
+                // Restore the original executable if copying the new binary failed.
+                try {
+                    renameSync(oldBinary, currentBinary);
+                }
+                catch { }
+                throw copyError;
+            }
+        }
+        else {
+            const stagedTarget = join(targetDir, `.dsh-tui-new-${process.pid}`);
+            copyFileSync(newBinaryPath, stagedTarget);
+            chmodSync(stagedTarget, 0o755);
+            renameSync(stagedTarget, currentBinary);
+        }
+        try {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch { }
+        return { success: true };
+    }
+    catch (error) {
+        try {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch { }
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
 /**
  * Classify this install against a fresh registry lookup: an update is
  * available, the install is already latest, or the answer is unknown
@@ -207,6 +392,16 @@ export async function resolveTuiUpdateTarget() {
     const currentVersion = current === undefined ? null : valid(current);
     if (currentVersion === null)
         return { kind: 'unknown' };
+    if (isStandaloneRuntime()) {
+        const ghRelease = await fetchGithubLatestRelease();
+        const latest = ghRelease?.version ?? (await fetchLatestVersion(resolveRegistryBase()));
+        if (latest === undefined)
+            return { kind: 'unknown' };
+        if (!gt(latest, currentVersion))
+            return { kind: 'latest', current: currentVersion, isStandalone: true };
+        const downloadUrl = ghRelease?.downloadUrl ?? `https://github.com/${GITHUB_REPO}/releases/download/v${latest}/${getStandaloneAssetName()}`;
+        return { kind: 'update', current: currentVersion, latest, isStandalone: true, downloadUrl };
+    }
     const registryBase = resolveRegistryBase();
     const [latest, official] = await Promise.all([
         fetchLatestVersion(registryBase),
@@ -226,7 +421,9 @@ export async function resolveTuiUpdateTarget() {
  */
 export async function checkForTuiUpdate() {
     const target = await resolveTuiUpdateTarget();
-    return target.kind === 'update' ? { current: target.current, latest: target.latest } : undefined;
+    return target.kind === 'update'
+        ? { current: target.current, latest: target.latest, isStandalone: target.isStandalone, downloadUrl: target.downloadUrl }
+        : undefined;
 }
 /**
  * Run a child process with its output attached to the user's terminal. The
@@ -279,6 +476,111 @@ export function tuiUpdatePluginArgs(profile, targetVersion) {
         ? ['plugin', '--profile', profile, 'update', '--latest', PACKAGE_NAME]
         : ['plugin', '--profile', profile, 'update', `${PACKAGE_NAME}@${targetVersion}`];
 }
+/**
+ * Postinstall-only transitive dependencies of the dsh-tui chain
+ * (dsh-auth → @earendil-works/pi-ai → @google/genai + protobufjs, plus the
+ * esbuild/koffi peers of that chain): pnpm ≥11 refuses to run their build
+ * scripts unless the workspace allowlists them, and a profile that never
+ * opted in fails the WHOLE install with ERR_PNPM_IGNORED_BUILDS. None of
+ * these scripts is needed at runtime (the repo root allowBuilds them all to
+ * `false`), so the update flow pre-seeds the profile's pnpm-workspace.yaml
+ * with explicit `false` entries — an explicit decision pnpm honors silently.
+ */
+const PROFILE_ALLOW_BUILDS = {
+    '@google/genai': false,
+    esbuild: false,
+    koffi: false,
+    protobufjs: false,
+};
+/** The profile's pnpm-workspace.yaml (`$DSH_HOME ?? ~/.dsh` layout). */
+export function profileWorkspaceYamlPath(profile) {
+    const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh');
+    return join(dshHome, 'profiles', profile, 'pnpm-workspace.yaml');
+}
+/** YAML key spelling for an allowBuilds entry (scoped names need quotes). */
+function allowBuildsKeyLine(key) {
+    const needsQuotes = key.includes('@') || key.includes('/');
+    return `  ${needsQuotes ? `'${key}'` : key}: false`;
+}
+/**
+ * Make sure the profile's pnpm-workspace.yaml carries explicit `false`
+ * allowBuilds entries for the dsh-tui chain's postinstall-only deps, so a
+ * pnpm ≥11 update is not killed by ERR_PNPM_IGNORED_BUILDS. Best effort and
+ * idempotent: existing entries are never overwritten (an explicit user
+ * decision wins), a missing `allowBuilds:` block is appended, and a missing
+ * file is created. Returns undefined when the profile directory is absent or
+ * the file could not be updated — the caller still runs pnpm, whose own
+ * ERR_PNPM_IGNORED_BUILDS diagnostic stays the visible fallback.
+ */
+export function ensureProfileAllowBuilds(profile) {
+    const yamlPath = profileWorkspaceYamlPath(profile);
+    try {
+        if (!existsSafe(dirname(yamlPath)))
+            return undefined;
+        let text = '';
+        try {
+            text = readFileSync(yamlPath, 'utf8');
+        }
+        catch {
+            // Missing file — start from an empty document; writeFileSync creates it.
+        }
+        const lines = text.split(/\r?\n/u);
+        let blockStart = -1;
+        for (let i = 0; i < lines.length; i += 1) {
+            const line = lines[i];
+            if (line !== '' && line === line.trimStart() && /^allowBuilds:/u.test(line)) {
+                blockStart = i;
+                break;
+            }
+        }
+        const present = new Set();
+        if (blockStart !== -1) {
+            for (let i = blockStart + 1; i < lines.length; i += 1) {
+                const line = lines[i];
+                if (line === '' || line === line.trimStart())
+                    break; // dedent = block ends
+                const keyMatch = /^\s+('?)(.+?)\1:\s/u.exec(line);
+                if (keyMatch !== null)
+                    present.add(keyMatch[2]);
+            }
+        }
+        const added = Object.keys(PROFILE_ALLOW_BUILDS).filter(key => !present.has(key));
+        if (added.length === 0)
+            return { existing: [...present], added };
+        const insert = added.map(allowBuildsKeyLine);
+        if (blockStart !== -1) {
+            // Append after the block's last existing entry (before the next
+            // top-level key), so existing entries keep their position.
+            let blockEnd = blockStart + 1;
+            for (let i = blockStart + 1; i < lines.length; i += 1) {
+                const line = lines[i];
+                if (line === '' || line === line.trimStart())
+                    break;
+                blockEnd = i + 1;
+            }
+            lines.splice(blockEnd, 0, ...insert);
+        }
+        else {
+            if (lines.length > 0 && lines[lines.length - 1] !== '')
+                lines.push('');
+            lines.push('allowBuilds:', ...insert);
+        }
+        writeFileSync(yamlPath, `${lines.join('\n')}\n`);
+        return { existing: [...present], added };
+    }
+    catch {
+        return undefined;
+    }
+}
+function existsSafe(path) {
+    try {
+        statSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The pnpm Windows tmp-rename race signature (issue #225): pnpm swaps a
  * package directory via a `<name>_tmp_<pid>` staging dir, and a file lock or
@@ -447,8 +749,37 @@ export async function updateTui(profile, targetVersion) {
     // process then compares new-vs-new and false-alarms "version did not
     // advance" on every successful update (issue #307's screenshots).
     const updatedFrom = installedTuiVersion() ?? '';
+    if (isStandaloneRuntime()) {
+        const target = await resolveTuiUpdateTarget();
+        const latestVersion = targetVersion ?? (target.kind === 'update' ? target.latest : undefined);
+        const downloadUrl = (target.kind === 'update' && target.downloadUrl)
+            ? target.downloadUrl
+            : (latestVersion ? `https://github.com/${GITHUB_REPO}/releases/download/v${latestVersion}/${getStandaloneAssetName()}` : undefined);
+        if (downloadUrl === undefined || latestVersion === undefined) {
+            process.stderr.write('dsh-tui: 无法解析便携包更新下载地址\n');
+            return { code: 1, updatedFrom };
+        }
+        process.stderr.write(`dsh-tui: 正在更新便携包 (${updatedFrom || 'current'} → ${latestVersion})…\n`);
+        const result = await downloadAndReplaceStandaloneBinary(downloadUrl, msg => {
+            process.stderr.write(`dsh-tui: ${msg}\n`);
+        });
+        if (!result.success) {
+            process.stderr.write(`dsh-tui: 便携包更新失败: ${result.error ?? '未知错误'}\n`);
+            return { code: 1, updatedFrom };
+        }
+        return { code: 0, updatedFrom, installed: latestVersion };
+    }
     const dsh = process.platform === 'win32' ? 'dsh.cmd' : 'dsh';
     const updateArgs = tuiUpdatePluginArgs(profile, targetVersion);
+    // pnpm ≥11 hard-fails installs whose dependency tree carries un-allowlisted
+    // build scripts (ERR_PNPM_IGNORED_BUILDS). The dsh-auth chain pulls in
+    // postinstall-only deps (@google/genai/protobufjs via pi-ai), so pre-seed
+    // the profile workspace with explicit `false` entries before pnpm runs.
+    const allowBuilds = ensureProfileAllowBuilds(profile);
+    if (allowBuilds !== undefined && allowBuilds.added.length > 0) {
+        process.stderr.write(`dsh-tui: pre-seeded profile pnpm allowBuilds (${allowBuilds.added.join(', ')}) — ` +
+            'postinstall-only deps are explicitly ignored\n');
+    }
     let updateStderr = '';
     const capture = (chunk) => { updateStderr += chunk; };
     let updateCode = await runProcess(dsh, updateArgs, { shell: true, onStderr: capture });
@@ -569,6 +900,18 @@ export async function cliUpdate(profile) {
         process.stdout.write(`dsh-tui: already the latest version (${target.current}).\n`);
         return 0;
     }
+    if (isStandaloneRuntime()) {
+        if (target.kind === 'update') {
+            process.stdout.write(`dsh-tui: updating standalone binary ${target.current} → ${target.latest}…\n`);
+            const outcome = await updateTui(profile, target.latest);
+            if (outcome.code === 0) {
+                process.stdout.write(`dsh-tui: standalone binary updated successfully (${outcome.updatedFrom || target.current} → ${outcome.installed}).\n`);
+            }
+            return outcome.code;
+        }
+        process.stderr.write('dsh-tui: version check failed (offline or unreachable registry).\n');
+        return 1;
+    }
     let targetVersion;
     if (target.kind === 'update') {
         // Mirror the /update flow exactly: refuse the 0.7.0–0.7.1 hard-inject

package/node_modules/@deepseek-harness-tui/dsh-auth/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ccch1mneyyy
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ccch1mneyyy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@deepseek-harness-tui/dsh-auth/dsh-plugin.json

@@ -1,44 +1,44 @@
-{
-  "$schema": "https://dsh.community/schemas/dsh-plugin-0.15.json",
-  "id": "com.dsh-tui.dsh-auth",
-  "name": "dsh-auth",
-  "version": "0.1.0",
-  "manifestVersion": "0.15",
-  "description": "Subscription OAuth sign-in (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as LLM provider routes for DeepSeek Harness. Registers llm adapter routes through the cordis llm registry; interactive login runs over the user-questions seam and degrades to a clear refusal when no interactive surface is present.",
-  "facets": {
-    "host": {
-      "entry": "lib/index.js",
-      "apiVersion": "v1alpha1"
-    }
-  },
-  "requires": {
-    "contracts": [
-      {
-        "apiVersion": "commands.dsh/v1alpha1",
-        "kind": "Command"
-      },
-      {
-        "apiVersion": "user-questions.dsh/v1alpha1",
-        "kind": "UserQuestions",
-        "optional": true,
-        "fallback": "login refuses with guidance instead of assuming a browser or GUI is present (TUI-RUN-001)"
-      }
-    ]
-  },
-  "contributes": {
-    "commands": [
-      {
-        "id": "dsh.auth",
-        "title": "Sign in with a provider subscription (OAuth)"
-      }
-    ]
-  },
-  "permissions": [
-    {
-      "name": "commands.invoke",
-      "scope": "dsh.auth",
-      "reason": "run /auth status|login|logout from any composed command surface"
-    }
-  ],
-  "license": "MIT"
-}
+{
+  "$schema": "https://dsh.community/schemas/dsh-plugin-0.15.json",
+  "id": "com.dsh-tui.dsh-auth",
+  "name": "dsh-auth",
+  "version": "0.1.0",
+  "manifestVersion": "0.15",
+  "description": "Subscription OAuth sign-in (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as LLM provider routes for DeepSeek Harness. Registers llm adapter routes through the cordis llm registry; interactive login runs over the user-questions seam and degrades to a clear refusal when no interactive surface is present.",
+  "facets": {
+    "host": {
+      "entry": "lib/index.js",
+      "apiVersion": "v1alpha1"
+    }
+  },
+  "requires": {
+    "contracts": [
+      {
+        "apiVersion": "commands.dsh/v1alpha1",
+        "kind": "Command"
+      },
+      {
+        "apiVersion": "user-questions.dsh/v1alpha1",
+        "kind": "UserQuestions",
+        "optional": true,
+        "fallback": "login refuses with guidance instead of assuming a browser or GUI is present (TUI-RUN-001)"
+      }
+    ]
+  },
+  "contributes": {
+    "commands": [
+      {
+        "id": "dsh.auth",
+        "title": "Sign in with a provider subscription (OAuth)"
+      }
+    ]
+  },
+  "permissions": [
+    {
+      "name": "commands.invoke",
+      "scope": "dsh.auth",
+      "reason": "run /auth status|login|logout from any composed command surface"
+    }
+  ],
+  "license": "MIT"
+}

package/node_modules/@dsh-std/command/CHANGELOG.md

@@ -1,8 +1,8 @@
-# Changelog
-
-Changes to `@dsh-std/command` are recorded here.
-
-## 0.1.0 (draft)
-
-- Defined portable command trees, arguments, options, catalogs, and invocation.
-- Added owner-aware command resource and runtime capability definitions.
+# Changelog
+
+Changes to `@dsh-std/command` are recorded here.
+
+## 0.1.0 (draft)
+
+- Defined portable command trees, arguments, options, catalogs, and invocation.
+- Added owner-aware command resource and runtime capability definitions.

package/node_modules/@dsh-std/command/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 DSH Standard contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 DSH Standard contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@dsh-std/command/README.md

@@ -1,26 +1,26 @@
-# @dsh-std/command
-
-English | [中文](README.zh.md)
-
-Named human-command resources and their shared callable Runtime dispatcher.
-
-## Contract
-
-A `Command` resource describes one root command and its nested subcommands. Nodes provide a title, localized titles, description, aliases, positional arguments, options, and child nodes. Arguments may be required, variadic, or restricted to documented values. Options declare every literal spelling and may accept one value.
-
-`CommandRuntime` defines the generic `catalog` and `execute` operations once for every command extension. A runtime adapter joins extensions published by active facets with its authoritative command registry and implements that capability. The execution context id remains opaque to the standard; a DSH adapter maps it to a session. Results contain only the command outcome. Invocation-scoped UI work uses typed clients from `@dsh-std/presentation`.
-
-`commandRuntime()` wraps a consumer-scoped `CapabilityClient` with typed methods, and `commandRuntimeImplementation()` builds the operation dispatcher for an adapter. Consumers and adapters do not repeat operation strings or payload validation.
-
-Presentation clients can build completion trees and forms without importing the owning component. A component such as dsh-codex declares `Command/codex`; its selected facet publishes the handler in its local runtime and never defines a connection-specific method.
-
-Names and aliases are single tokens. Sibling names and aliases, argument names, option spellings, and enumerated values must be unique. A variadic argument must be last.
-
-## Extension points
-
-Fields prefixed with `x-` may carry experimental metadata. Portable clients ignore extensions they do not understand. Incompatible command semantics require a new contract major version rather than redefining an existing field.
-
-## Known Limitations and Deferred Work
-
-- The contract does not define a command-line parser or quoting rules.
-- Dynamic completion is not part of `v1alpha1`; declared values are static.
+# @dsh-std/command
+
+English | [中文](README.zh.md)
+
+Named human-command resources and their shared callable Runtime dispatcher.
+
+## Contract
+
+A `Command` resource describes one root command and its nested subcommands. Nodes provide a title, localized titles, description, aliases, positional arguments, options, and child nodes. Arguments may be required, variadic, or restricted to documented values. Options declare every literal spelling and may accept one value.
+
+`CommandRuntime` defines the generic `catalog` and `execute` operations once for every command extension. A runtime adapter joins extensions published by active facets with its authoritative command registry and implements that capability. The execution context id remains opaque to the standard; a DSH adapter maps it to a session. Results contain only the command outcome. Invocation-scoped UI work uses typed clients from `@dsh-std/presentation`.
+
+`commandRuntime()` wraps a consumer-scoped `CapabilityClient` with typed methods, and `commandRuntimeImplementation()` builds the operation dispatcher for an adapter. Consumers and adapters do not repeat operation strings or payload validation.
+
+Presentation clients can build completion trees and forms without importing the owning component. A component such as dsh-codex declares `Command/codex`; its selected facet publishes the handler in its local runtime and never defines a connection-specific method.
+
+Names and aliases are single tokens. Sibling names and aliases, argument names, option spellings, and enumerated values must be unique. A variadic argument must be last.
+
+## Extension points
+
+Fields prefixed with `x-` may carry experimental metadata. Portable clients ignore extensions they do not understand. Incompatible command semantics require a new contract major version rather than redefining an existing field.
+
+## Known Limitations and Deferred Work
+
+- The contract does not define a command-line parser or quoting rules.
+- Dynamic completion is not part of `v1alpha1`; declared values are static.