@deepseek-harness-tui/dsh-tui 0.9.3 → 0.10.0-beta.2

package/lib/types/components/smoothReveal.js

@@ -0,0 +1,279 @@
+/**
+ * Smooth streaming reveal — decouples "text the provider has delivered" from
+ * "text the screen is showing" (the oh-my-pi `display.smoothStreaming` idea,
+ * see their `StreamingRevealController`). A shared ~30fps scheduler advances
+ * each reveal cursor by an adaptive catch-up step, so burst-delivered text (a
+ * slow provider dumping a large batch, or a non-streaming response arriving
+ * whole) paints as a brief even flow instead of one jarring jump, while
+ * genuinely streaming text is re-paced to a steady cadence regardless of
+ * chunk timing.
+ *
+ * Step math (per frame): `max(MIN_STEP, ceil(backlog / CATCHUP_FRAMES))` —
+ * an EXPONENTIAL decay over the backlog (each frame removes ~1/8 of what is
+ * still unrevealed, the oh-my-pi semantics exactly): a large burst lands its
+ * first three quarters within a few frames, the remainder tapers, and the
+ * MIN_STEP floor turns the tail into a steady linear crawl so the reveal
+ * always finishes. A ~2000-character one-shot delivery paints fully in
+ * roughly 1.5s; genuinely streaming text (small backlogs) paces at a steady
+ * per-frame rate. The reveal never runs ahead of what has arrived.
+ *
+ * ARCHITECTURE — module-level cursors, not component state. dsh-tui's
+ * transcript virtualization feeds on MemoRow prop changes (flattened
+ * primitives) and re-measures mounted rows after every MessageList commit;
+ * a reveal living in child-component state would change row heights without
+ * touching those props, and the memo/signature/height-measure chain would
+ * never notice (stale cached heights → blank bands). Instead the cursors
+ * live here keyed by row identity, the READS happen during render (they feed
+ * the same flattened `text` prop the streaming path already uses), and the
+ * WRITES happen on the scheduler tick, which bumps a version that
+ * MessageList subscribes to via useSyncExternalStore. A reveal therefore
+ * rides the exact same update pipeline as an arriving chunk: prop change →
+ * memo miss → re-render → post-commit measurement. Render-phase reads are
+ * idempotent and safe to re-run (a discarded concurrent render at worst
+ * creates a cursor the tick soon retires).
+ *
+ * Unit model: reveal positions are UTF-16 code units (Chinese text is one
+ * unit per character). Surrogate pairs are never split (see {@link
+ * safeSliceEnd}); grapheme clusters longer than a surrogate pair (emoji ZWJ
+ * chains) may briefly show a partial cluster mid-reveal — transient frames
+ * repaint within 33ms, and settled rendering is always the full text.
+ */
+/** Reveal tick cadence — ~30fps, matching oh-my-pi's controller. */
+export const REVEAL_FRAME_MS = 1000 / 30;
+/** Minimum units (code units or lines) advanced per tick while work remains. */
+export const REVEAL_MIN_STEP = 3;
+/** Catch-up bound: the reveal settles any backlog within this many frames. */
+export const REVEAL_CATCHUP_FRAMES = 8;
+/** Adaptive per-frame step for a backlog (exported for tests). */
+export function revealStep(backlog) {
+    return Math.max(REVEAL_MIN_STEP, Math.ceil(Math.max(0, backlog) / REVEAL_CATCHUP_FRAMES));
+}
+/**
+ * Slice boundary guard: never split a surrogate pair. When the boundary lands
+ * between a high and a low surrogate, take the pair if the low half has
+ * arrived, otherwise step back one unit — showing one fewer character for a
+ * frame beats feeding a lone surrogate into markdown rendering.
+ */
+function safeSliceEnd(text, end) {
+    if (end <= 0)
+        return 0;
+    if (end >= text.length)
+        return text.length;
+    const code = text.charCodeAt(end - 1);
+    if (code >= 0xd800 && code <= 0xdbff) {
+        return end + 1 < text.length ? end + 1 : end - 1;
+    }
+    return end;
+}
+const textCursors = new Map();
+const countCursors = new Map();
+/**
+ * Keys whose reveal has COMPLETED (caught up, snapped, or replaced). A
+ * completed key must not re-create a cursor on a later active read — the
+ * content is already fully on screen, and re-revealing would blank it and
+ * typewrite again. Bounded FIFO: well past the cap these are all ancient
+ * history (the row ids are gone); dropping the oldest half only risks a
+ * long-unmounted row re-revealing, which is harmless (it paints full via
+ * the active=false path anyway once unmounted... and a remounted streaming
+ * row WANTS the reveal).
+ */
+const completedReveals = new Set();
+const COMPLETED_REVEALS_MAX = 2048;
+function markRevealCompleted(key) {
+    if (completedReveals.size >= COMPLETED_REVEALS_MAX) {
+        let drop = COMPLETED_REVEALS_MAX / 2;
+        for (const old of completedReveals) {
+            if (drop-- <= 0)
+                break;
+            completedReveals.delete(old);
+        }
+    }
+    completedReveals.add(key);
+}
+// ---------------------------------------------------------------------------
+// Scheduler + version store (useSyncExternalStore-compatible)
+// ---------------------------------------------------------------------------
+let revealTimer = undefined;
+let revealVersionValue = 0;
+const revealListeners = new Set();
+function ensureRevealTimer() {
+    if (revealTimer === undefined) {
+        revealTimer = setInterval(revealTick, REVEAL_FRAME_MS);
+        revealTimer.unref?.();
+    }
+}
+function stopRevealTimerIfIdle() {
+    if (textCursors.size === 0 && countCursors.size === 0 && revealTimer !== undefined) {
+        clearInterval(revealTimer);
+        revealTimer = undefined;
+    }
+}
+function revealTick() {
+    let advanced = false;
+    for (const [key, cursor] of textCursors) {
+        const total = cursor.text.length;
+        if (cursor.revealed >= total) {
+            textCursors.delete(key);
+            markRevealCompleted(key);
+            continue;
+        }
+        cursor.revealed = Math.min(total, cursor.revealed + revealStep(total - cursor.revealed));
+        advanced = true;
+    }
+    for (const [key, cursor] of countCursors) {
+        if (cursor.revealed >= cursor.total) {
+            countCursors.delete(key);
+            markRevealCompleted(key);
+            continue;
+        }
+        cursor.revealed = Math.min(cursor.total, cursor.revealed + revealStep(cursor.total - cursor.revealed));
+        advanced = true;
+    }
+    if (advanced) {
+        revealVersionValue += 1;
+        for (const listener of [...revealListeners])
+            listener();
+    }
+    else {
+        stopRevealTimerIfIdle();
+    }
+}
+/** Subscribe to reveal-frame wakeups (MessageList + tool cards). */
+export function subscribeReveal(listener) {
+    revealListeners.add(listener);
+    return () => {
+        revealListeners.delete(listener);
+    };
+}
+/** Snapshot for useSyncExternalStore; bumps once per advancing tick. */
+export function getRevealVersion() {
+    return revealVersionValue;
+}
+/** Force-complete (and forget) a cursor: expanded card, replaced view, … */
+export function snapReveal(key) {
+    if (textCursors.delete(key) || countCursors.delete(key))
+        markRevealCompleted(key);
+}
+/**
+ * Revealed length of `text` for `key` — the cursor logic of
+ * {@link revealTextOf} without the slice allocation (layout signatures read
+ * this every render for every visible row).
+ */
+export function revealLengthOf(key, text, options) {
+    if (!options.enabled) {
+        // Mid-stream settings toggle off: retire any cursor, show everything.
+        if (textCursors.delete(key)) {
+            markRevealCompleted(key);
+            stopRevealTimerIfIdle();
+        }
+        return text.length;
+    }
+    const existing = textCursors.get(key);
+    if (existing === undefined) {
+        // Completed earlier (caught up / snapped / replaced): paint full — a
+        // re-reveal would blank the already-complete content and typewrite it
+        // again.
+        if (completedReveals.has(key))
+            return text.length;
+        if (!options.active)
+            return text.length;
+        textCursors.set(key, { text, revealed: 0 });
+        ensureRevealTimer();
+        return 0;
+    }
+    if (text !== existing.text) {
+        if (text.startsWith(existing.text)) {
+            existing.text = text;
+            ensureRevealTimer();
+        }
+        else {
+            // Replacement: snap to the new text in full.
+            textCursors.delete(key);
+            markRevealCompleted(key);
+            stopRevealTimerIfIdle();
+            return text.length;
+        }
+    }
+    return Math.min(existing.revealed, text.length);
+}
+/**
+ * Revealed prefix of `text` for `key`. Monotonic appends (streaming deltas)
+ * keep the cursor; a non-prefix replacement (rewind, folded preview
+ * truncation) snaps to the new text — never animate across a discontinuity
+ * the reader did not witness as streaming. Feed the result into the
+ * streaming renderer (StreamingMarkdown); the monotonic prefix it receives
+ * keeps its stable-prefix memoization fully effective.
+ */
+export function revealTextOf(key, text, options) {
+    const len = revealLengthOf(key, text, options);
+    if (len >= text.length)
+        return text;
+    return text.slice(0, safeSliceEnd(text, len));
+}
+/**
+ * Revealed unit count for `key` over `total` units (tool-card body lines,
+ * split-diff rows). A SMALLER total always snaps (content that shrank is a
+ * replacement, not an append); growth keeps the cursor. Callers own the
+ * append-vs-replace decision for growing totals (pass a fresh key or call
+ * {@link snapReveal} when the content behind the same key is replaced).
+ */
+export function revealLinesOf(key, total, options) {
+    if (total <= REVEAL_MIN_STEP) {
+        // Nothing worth animating (a one-line "Running…" card): retire and
+        // return full — also covers total === 0.
+        if (countCursors.delete(key)) {
+            markRevealCompleted(key);
+            stopRevealTimerIfIdle();
+        }
+        return total;
+    }
+    if (!options.enabled) {
+        if (countCursors.delete(key)) {
+            markRevealCompleted(key);
+            stopRevealTimerIfIdle();
+        }
+        return total;
+    }
+    const existing = countCursors.get(key);
+    if (existing === undefined) {
+        if (completedReveals.has(key))
+            return total;
+        if (!options.active)
+            return total;
+        countCursors.set(key, { total, revealed: 0 });
+        ensureRevealTimer();
+        return 0;
+    }
+    if (total !== existing.total) {
+        if (total > existing.total) {
+            existing.total = total;
+            ensureRevealTimer();
+        }
+        else {
+            countCursors.delete(key);
+            markRevealCompleted(key);
+            stopRevealTimerIfIdle();
+            return total;
+        }
+    }
+    return Math.min(existing.revealed, total);
+}
+// ---------------------------------------------------------------------------
+// Test seams
+// ---------------------------------------------------------------------------
+/** Clear every cursor/listener/timer (verify scripts between cases). */
+export function resetRevealForTest() {
+    textCursors.clear();
+    countCursors.clear();
+    completedReveals.clear();
+    revealListeners.clear();
+    if (revealTimer !== undefined) {
+        clearInterval(revealTimer);
+        revealTimer = undefined;
+    }
+    revealVersionValue = 0;
+}
+/** Whether the shared scheduler currently runs (refcount assertions). */
+export function isRevealTimerRunning() {
+    return revealTimer !== undefined;
+}

package/lib/types/customTheme.d.ts

@@ -38,6 +38,10 @@ export type CustomThemeSpec = {
     /** The underlying file name without .json — the on-disk load key. */
     file: string;
 };
+/** Whether a value names one of the three built-in overlay palettes. */
+export declare function isThemeBase(value: unknown): value is ThemeBase;
+/** Whether a value is an own key of the complete Theme contract. */
+export declare function isThemeKey(value: unknown): value is keyof Theme;
 /**
  * Whether a name is safe to use as a file name (no path separators or dot
  * traversal). Theme names are user input from DSH_TUI_THEME and /theme, so

package/lib/types/customTheme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customTheme.d.ts","sourceRoot":"","sources":["../../src/customTheme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAA0C,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAG/E,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,yCAA0C,CAAA;AACvE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzD,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,QAA2B,CAAA;AAExD,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG;IAC5B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,IAAI,EAAE,SAAS,CAAA;IACf,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACtB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AA2CD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAUjE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,eAAe,GAAG,SAAS,CAqE7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAyB,GAC7B,eAAe,GAAG,SAAS,CAQ7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAyB,GAAG,eAAe,EAAE,CAclF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,KAAK,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAWlE;AAcD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C"}
+{"version":3,"file":"customTheme.d.ts","sourceRoot":"","sources":["../../src/customTheme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAA6B,KAAK,KAAK,EAAE,MAAM,YAAY,CAAA;AAGlE,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,yCAA0C,CAAA;AACvE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzD,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,QAA2B,CAAA;AAExD,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG;IAC5B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,IAAI,EAAE,SAAS,CAAA;IACf,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACtB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAuCD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,KAAK,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAUjE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,eAAe,GAAG,SAAS,CAoE7B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAyB,GAC7B,eAAe,GAAG,SAAS,CAQ7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAyB,GAAG,eAAe,EAAE,CAclF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,KAAK,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAWlE;AAcD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,IAAI,IAAI,CAI5C"}

package/lib/types/customTheme.js

@@ -61,8 +61,13 @@ const cache = new Map();
  */
 const nameIndex = new Map();
 let nameIndexed = false;
-function isThemeBase(value) {
-    return THEME_BASE_NAMES.includes(value);
+/** Whether a value names one of the three built-in overlay palettes. */
+export function isThemeBase(value) {
+    return typeof value === 'string' && THEME_BASE_NAMES.includes(value);
+}
+/** Whether a value is an own key of the complete Theme contract. */
+export function isThemeKey(value) {
+    return typeof value === 'string' && Object.prototype.hasOwnProperty.call(getTheme('dark'), value);
 }
 /**
  * Whether a name is safe to use as a file name (no path separators or dot
@@ -152,12 +157,11 @@ export function parseCustomTheme(text, fileName) {
         warn(`theme "${fileName}": "colors" must be an object; file skipped`);
         return undefined;
     }
-    // Key/color validation against the base palette, so unknown keys and bad
+    // Key/color validation against the Theme contract, so unknown keys and bad
     // values are skipped per key (warned) instead of killing the theme.
-    const baseTheme = getTheme(base);
     const colors = {};
     for (const [key, value] of Object.entries(colorsRaw)) {
-        if (!(key in baseTheme)) {
+        if (!isThemeKey(key)) {
             warn(`theme "${fileName}": unknown color key "${key}" skipped`);
             continue;
         }

package/lib/types/dsh-adapter/approvals.d.ts

@@ -14,6 +14,7 @@
  * no allow-always or feedback channel in the protocol.
  */
 import type { ApprovalOutcome, ApprovalRequest } from '@deepseek-ai/dsh-user-approval';
+import type { SessionEvent } from '@deepseek-ai/dsh-session';
 /** What the TUI renders while an approval is pending. */
 export interface ApprovalSnapshot {
     /** Stable key so the panel remounts (fresh focus state) per request. */
@@ -23,6 +24,22 @@ export interface ApprovalSnapshot {
     readonly reason?: string;
     /** The gated command, recovered from the paired tool/call event. */
     readonly command?: string;
+    /**
+     * The request is not anchored to a live tool call of this session (no or
+     * unknown callId, the paired call already settled, or the callId is
+     * already in flight or consumed by another ask — a genuine approval is
+     * asked exactly once per call). A duplicate callId marks EVERY ask on it
+     * (the pre-existing one included — attacker-first order) so the verdict
+     * can never invert onto the genuine ask). The approval waterfall is an in-process event
+     * any plugin can dispatch, so the panel renders a loud warning instead of
+     * presenting the text as the agent's own pending command. Verdicts that
+     * depend on the session log are re-checked while the ask is queued or on
+     * the panel, so they may also appear late — once a same-callId sibling
+     * ask is allowed and its tool/result lands (P-4). The in-flight dedup
+     * verdict, by contrast, is determined at park() and needs no result to
+     * land.
+     */
+    readonly external?: true;
 }
 /**
  * Approval store: parks asks from the harness's approval seam, surfaces
@@ -40,6 +57,30 @@ export declare class ApprovalStore {
      * nothing changed (a fresh object per call would loop re-renders).
      */
     private snapshotCache;
+    /**
+     * Length of the session log at the last liveness evaluation of the active
+     * ask. Events only append, so an unchanged length means no verdict can
+     * have flipped — re-checks below this guard are skipped.
+     */
+    private externalCheckedAtEvents;
+    private notifyQueued;
+    /**
+     * CallIds whose approval ask already settled (decided or cancelled).
+     * Together with the in-flight set this closes the park-after-decide gap:
+     * the first ask leaves the queue while its tool is still executing (the
+     * callId still reads live), so a twin parked in that window would dodge
+     * both the in-flight dedup and the liveness check. A consumed callId
+     * never legitimately comes back: the permission layer asks once per call.
+     * Fails toward the badge — a hypothetical genuine re-ask after a cancel
+     * shows the warning, never the reverse. Evicted when the paired
+     * tool/result lands (after that the liveness check marks the twin
+     * anyway), keeping the set bounded to in-flight tool executions.
+     * Keys are agent-scoped (`agentId::callId`): the store outlives agent
+     * switches (/resume, /new) and low-entropy callIds (provider fallback
+     * `call-<index>`) repeat across sessions — a bare-callId key would badge
+     * the next session's genuine ask with the previous session's residue.
+     */
+    private readonly consumedCallIds;
     /**
      * Subscribe to store changes (useSyncExternalStore contract).
      * @param listener - Called after every mutation that changes the snapshot.
@@ -47,13 +88,63 @@ export declare class ApprovalStore {
      */
     subscribe(listener: () => void): () => void;
     /**
-     * The approval the TUI should render now, or null when idle.
+     * The approval the TUI should render now, or null when idle. Re-checks the
+     * active ask's source badge against the current session log (see
+     * {@link refreshActiveExternal}) so a badge that flips while the ask is on
+     * the panel surfaces without waiting for another store mutation.
      * @returns The cached snapshot; the reference is stable between mutations.
      */
     getSnapshot(): ApprovalSnapshot | null;
     private emit;
+    /** Notify on a microtask so a re-check triggered inside getSnapshot
+     * (during a React render) never fires listeners synchronously mid-render. */
+    private scheduleNotify;
     /** Rebuild the cached snapshot after any mutation of active. */
     private rebuildSnapshot;
+    /**
+     * Re-run the source-badge verdict for the active ask (P-4).
+     *
+     * The external flag computed at park() is only a point-in-time verdict. A
+     * forger can dispatch a second request carrying the SAME callId as a
+     * genuinely pending one — both look live at park time; once the first is
+     * allowed and its tool/result lands, the twin surfaces with a callId that
+     * no longer has an unresolved call and must not keep the unmarked panel
+     * data. Re-checked when an ask becomes active (promotion), whenever the
+     * snapshot is read (the result usually lands AFTER the twin was promoted),
+     * and on every session `tool/result` notification (see
+     * {@link noteSessionEvent}). The session log only appends, so the verdict
+     * can only flip live→external, never back — the badge may appear late but
+     * never falsely.
+     */
+    private refreshActiveExternal;
+    /**
+     * Session-event notification inlet (wired by plugin.ts to the
+     * `session/event` firehose). React does not know the session log
+     * appended: a badge flip that only happens inside getSnapshot() surfaces
+     * solely when something ELSE re-renders the panel (a streaming spinner,
+     * say) — a silent render loop leaves the unmarked panel on screen. A
+     * landed `tool/result` is the only event type that can flip the active
+     * verdict live→external, so everything else is dropped here; the internal
+     * length memo then skips the recheck whenever the event belongs to a
+     * different session than the active ask's. The notification the SDK
+     * fires arrives after the event is already in `session.events`, so the
+     * recheck sees the settled result.
+     * @param event - The appended session event.
+     */
+    noteSessionEvent(event: SessionEvent): void;
+    /**
+     * Whether another ask with this callId is already parked (active or
+     * queued). A genuine approval is raised once per gated tool call — the
+     * permission layer asks, waits, and never re-asks for the same callId —
+     * so a second ask reusing an in-flight callId is a forged twin dispatched
+     * through the in-process waterfall. This is a DETERMINISTIC verdict: it
+     * needs no tool/result to land, unlike {@link isLiveToolApproval}, whose
+     * twin-reveal window (result lands only after the first ask is allowed
+     * and the tool runs) is exactly when promotion-time rechecks still see no
+     * result. Derived from the live active+queue set on each park(), so
+     * settled asks free their callId automatically.
+     */
+    private isCallIdInFlight;
     /**
      * Answerer entry point — called by the `approval/request` waterfall
      * listener when the ask concerns the agent this TUI owns.
@@ -62,7 +153,10 @@ export declare class ApprovalStore {
      *   when the ask is withdrawn or the plugin tears down.
      */
     park(req: ApprovalRequest): Promise<ApprovalOutcome>;
-    /** Advance to the next queued ask, if any. */
+    /** Advance to the next queued ask, if any. The promoted ask's source
+     * badge is re-checked against the log that has kept appending since it
+     * was parked (P-4: a same-callId twin parked while live may surface long
+     * after its call settled). */
     private startNext;
     /**
      * The user decided on the current approval; settles it and drains the
@@ -76,5 +170,23 @@ export declare class ApprovalStore {
      * @param outcome - The outcome every pending ask resolves with.
      */
     settleAll(outcome: ApprovalOutcome): void;
+    /**
+     * Record a settling ask's callId as consumed (see {@link consumedCallIds}).
+     * @param pending - The ask leaving the active/queue set.
+     */
+    private noteConsumed;
+    /**
+     * A same-callId duplicate just parked: every pending ask on that callId is
+     * now source-ambiguous. The forged-first order parks the fake ask clean
+     * (isLive true, no duplicate visible yet) and the genuine follow-up would
+     * carry the only badge — an inverted verdict. Flip them all, then rebuild
+     * + notify so an on-screen panel updates immediately. refreshActiveExternal
+     * early-returns on an existing external verdict, so the marking is
+     * monotonic and never erased. Deliberately badges instead of cancelling:
+     * cancelling both would hand the attacker a force-cancel primitive
+     * against genuine approvals.
+     * @param callId - The duplicated call id (non-undefined by construction).
+     */
+    private markCallIdAmbiguous;
 }
 //# sourceMappingURL=approvals.d.ts.map

package/lib/types/dsh-adapter/approvals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAGtF,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AA0CD;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,GAAG,CAAI;IACf;;;OAGG;IACH,OAAO,CAAC,aAAa,CAAgC;IAErD;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;OAGG;IACH,WAAW,IAAI,gBAAgB,GAAG,IAAI;IAItC,OAAO,CAAC,IAAI;IAIZ,gEAAgE;IAChE,OAAO,CAAC,eAAe;IAOvB;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IA8BpD,8CAA8C;IAC9C,OAAO,CAAC,SAAS;IAOjB;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,GAAG,IAAI;IAUlD;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;CAQ1C"}
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE5D,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CACzB;AAgGD;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,GAAG,CAAI;IACf;;;OAGG;IACH,OAAO,CAAC,aAAa,CAAgC;IACrD;;;;OAIG;IACH,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,YAAY,CAAQ;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAoB;IAEpD;;;;OAIG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C;;;;;;OAMG;IACH,WAAW,IAAI,gBAAgB,GAAG,IAAI;IAKtC,OAAO,CAAC,IAAI;IAIZ;iFAC6E;IAC7E,OAAO,CAAC,cAAc;IAStB,gEAAgE;IAChE,OAAO,CAAC,eAAe;IAOvB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAiB3C;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,gBAAgB;IAQxB;;;;;;OAMG;IACH,IAAI,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAyDpD;;;kCAG8B;IAC9B,OAAO,CAAC,SAAS;IAUjB;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,GAAG,IAAI;IAWlD;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAazC;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,mBAAmB;CAoB5B"}