@dsh-enhanced/coding-subscription-provider 0.1.3 → 0.1.5

package/lib/providers.js

@@ -1,32 +1,135 @@
+/**
+ * Codex 0.147 feature keys that can expose a provider-owned executor, lifecycle
+ * hook, skill/plugin instruction, or capability-discovery path. Keep this list
+ * mirrored by scripts/capture-cli-fixtures.mjs and covered by the exact argv
+ * tests below. The protocol decoder remains the final fail-closed boundary.
+ */
+export const CODEX_DISABLED_NATIVE_FEATURES = [
+    'shell_tool',
+    'shell_zsh_fork',
+    'unified_exec_zsh_fork',
+    'shell_snapshot',
+    'deferred_executor',
+    'js_repl',
+    'js_repl_tools_only',
+    'view_image',
+    'hooks',
+    'code_mode',
+    'code_mode_buffered_exec',
+    'code_mode_host',
+    'code_mode_only',
+    'web_search_request',
+    'web_search_cached',
+    'search_tool',
+    'memories',
+    'external_agent_memory_import',
+    'apply_patch_freeform',
+    'apply_patch_streaming_events',
+    'exec_permission_approvals',
+    'request_rule',
+    'multi_agent',
+    'multi_agent_v2',
+    'multi_agent_mode',
+    'collaboration_modes',
+    'apps',
+    'enable_mcp_apps',
+    'mcp_2026_07_28',
+    'apps_mcp_path_override',
+    'tool_search',
+    'deferred_tool_world_state',
+    'non_prefixed_mcp_tool_names',
+    'unavailable_dummy_tools',
+    'tool_suggest',
+    'recommended_plugins',
+    'plugins',
+    'executor_capability_discovery',
+    'plugin_hooks',
+    'in_app_browser',
+    'browser_use',
+    'browser_use_full_cdp_access',
+    'browser_use_external',
+    'computer_use',
+    'remote_plugin',
+    'plugin_sharing',
+    'image_generation',
+    'skill_mcp_dependency_install',
+    'skill_search',
+    'skill_env_var_dependency_prompt',
+    'standalone_web_search',
+    'default_mode_request_user_input',
+    'request_permissions_tool',
+    'token_budget',
+    'current_time_reminder',
+    'terminal_visualization_instructions',
+    'guardian_approval',
+    'guardianv2',
+    'goals',
+    'tool_call_mcp_elicitation',
+    'auth_elicitation',
+    'artifact',
+    'workspace_dependencies',
+];
+const codexDisabledNativeFeatureArgs = CODEX_DISABLED_NATIVE_FEATURES
+    .flatMap(feature => ['--disable', feature]);
+/** Codex config paths that suppress repository-, skill-, and host-owned prompt/tool injection. */
+export const CODEX_NATIVE_BOUNDARY_CONFIG_OVERRIDES = [
+    'project_doc_max_bytes=0',
+    'skills.include_instructions=false',
+    'skills.bundled.enabled=false',
+    'orchestrator.skills.enabled=false',
+    'orchestrator.mcp.enabled=false',
+    'include_apps_instructions=false',
+    'include_permissions_instructions=false',
+    'include_environment_context=false',
+    'include_collaboration_mode_instructions=false',
+    'tools.update_plan.enabled=false',
+    'tools.experimental_request_user_input.enabled=false',
+    'web_search="disabled"',
+    'agents.enabled=false',
+];
+const codexNativeBoundaryConfigArgs = CODEX_NATIVE_BOUNDARY_CONFIG_OVERRIDES
+    .flatMap(value => ['--config', value]);
 export const providerPresets = {
     codex: {
         id: 'codex',
         command: 'codex',
-        // Codex owns its own authenticated subscription session. The sandbox blocks writes.
-        args: ['exec', '--json', '--ephemeral', '--ignore-user-config', '--sandbox', 'read-only'],
+        // Codex owns its own authenticated subscription session. Ignore local config/rules,
+        // remove known model-visible native capabilities, and keep residual built-ins read-only.
+        // The stdout decoder still rejects any native tool lifecycle event that escapes
+        // these best-effort launch boundaries.
+        args: [
+            'exec', '--json', '--ephemeral', '--ignore-user-config', '--ignore-rules',
+            // The cwd has already been reconstructed from the live Host session and
+            // compared by canonical realpath.  The standard assistant workspace is
+            // intentionally not required to be a Git repository.
+            '--skip-git-repo-check',
+            ...codexDisabledNativeFeatureArgs,
+            ...codexNativeBoundaryConfigArgs,
+            '--sandbox', 'read-only',
+        ],
         output: 'ndjson',
     },
     claude: {
         id: 'claude',
         command: 'claude',
-        // No tools means DSH receives a text-only delegation by default.
+        // Disable Claude-native tools; DSH calls return through the outer JSON bridge.
         args: ['-p', '--output-format', 'stream-json', '--verbose', '--include-partial-messages', '--no-session-persistence', '--safe-mode', '--permission-mode', 'dontAsk', '--tools', ''],
         output: 'ndjson',
     },
     cursor: {
         id: 'cursor',
         command: 'cursor-agent',
-        // Intentionally no --force or equivalent approval-bypass flag.
-        args: ['--print', '--output-format', 'stream-json'],
+        // Ask mode is the strongest current headless boundary. Intentionally never
+        // pass --force or another approval bypass; read-only search may still occur.
+        args: ['--print', '--output-format', 'stream-json', '--mode=ask'],
         output: 'ndjson',
     },
     grok: {
         id: 'grok',
         command: 'grok',
-        // `-p` consumes the following argv item, so buildInvocation inserts the task
-        // immediately after it before appending these fixed headless flags. Grok treats
-        // an empty --tools value as no filter, so allow then deny its always-on MCP
-        // meta-tools to produce an actually empty tool set for this text-only route.
+        // Grok treats an empty --tools value as no filter, so allow then deny its
+        // always-on MCP meta-tools to produce an actually empty native tool set. DSH
+        // calls use the outer JSON bridge instead of Grok's internal executor.
         args: [
             '--output-format', 'streaming-json', '--permission-mode', 'dontAsk',
             '--no-auto-update', '--no-memory', '--no-subagents', '--disable-web-search', '--verbatim',
@@ -35,11 +138,15 @@ export const providerPresets = {
         output: 'ndjson',
     },
 };
-export function buildInvocation(provider, options) {
+export function buildInvocation(provider, options, _platform = process.platform) {
     const preset = providerPresets[provider];
-    const args = provider === 'grok'
-        ? ['-p', options.prompt, ...preset.args]
-        : [...preset.args];
+    // Grok 1.0.5 reopens its --prompt-file path instead of consuming the inherited
+    // stdin stream. `/dev/stdin` can therefore fail with ENXIO under child_process,
+    // so use the same private-file transport on every supported platform.
+    const promptTransport = provider === 'grok'
+        ? 'secure-temporary-file'
+        : 'stdin';
+    const args = [...preset.args];
     if (options.model && options.model !== 'default')
         args.push('--model', options.model);
     if (provider === 'codex' && options.reasoningEffort) {
@@ -54,8 +161,19 @@ export function buildInvocation(provider, options) {
     if (options.maxTurns !== undefined && (provider === 'claude' || provider === 'grok')) {
         args.push('--max-turns', String(options.maxTurns));
     }
-    if (provider !== 'grok')
-        args.push(options.prompt);
-    return { provider, command: options.command ?? preset.command, args, cwd: options.cwd, shell: false };
+    // Use the documented positional sentinel even though some Codex releases
+    // also infer stdin when PROMPT is omitted.  Keeping it last prevents a future
+    // parser change from treating a following option as prompt content.
+    if (provider === 'codex')
+        args.push('-');
+    return {
+        provider,
+        command: options.command ?? preset.command,
+        args,
+        prompt: options.prompt,
+        promptTransport,
+        cwd: options.cwd,
+        shell: false,
+    };
 }
 //# sourceMappingURL=providers.js.map

package/lib/providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AA+BA,MAAM,CAAC,MAAM,eAAe,GAAiD;IAC3E,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,OAAO,EAAE,OAAO;QAChB,oFAAoF;QACpF,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,WAAW,EAAE,WAAW,CAAC;QACzF,MAAM,EAAE,QAAQ;KACjB;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,QAAQ;QACjB,iEAAiE;QACjE,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,aAAa,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC;QACnL,MAAM,EAAE,QAAQ;KACjB;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,cAAc;QACvB,+DAA+D;QAC/D,IAAI,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,aAAa,CAAC;QACnD,MAAM,EAAE,QAAQ;KACjB;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,OAAO,EAAE,MAAM;QACf,6EAA6E;QAC7E,gFAAgF;QAChF,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,EAAE;YACJ,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS;YACnE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY;YACzF,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAsB;SACvE;QACD,MAAM,EAAE,QAAQ;KACjB;CACF,CAAA;AAED,MAAM,UAAU,eAAe,CAAC,QAAoB,EAAE,OAA0B;IAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,QAAQ,KAAK,MAAM;QAC9B,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAEpB,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACrF,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACvG,CAAC"}
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAmCA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,YAAY;IACZ,gBAAgB;IAChB,uBAAuB;IACvB,gBAAgB;IAChB,mBAAmB;IACnB,SAAS;IACT,oBAAoB;IACpB,YAAY;IACZ,OAAO;IACP,WAAW;IACX,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,8BAA8B;IAC9B,sBAAsB;IACtB,8BAA8B;IAC9B,2BAA2B;IAC3B,cAAc;IACd,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,qBAAqB;IACrB,MAAM;IACN,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,aAAa;IACb,2BAA2B;IAC3B,6BAA6B;IAC7B,yBAAyB;IACzB,cAAc;IACd,qBAAqB;IACrB,SAAS;IACT,+BAA+B;IAC/B,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,6BAA6B;IAC7B,sBAAsB;IACtB,cAAc;IACd,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,8BAA8B;IAC9B,cAAc;IACd,iCAAiC;IACjC,uBAAuB;IACvB,iCAAiC;IACjC,0BAA0B;IAC1B,cAAc;IACd,uBAAuB;IACvB,qCAAqC;IACrC,mBAAmB;IACnB,YAAY;IACZ,OAAO;IACP,2BAA2B;IAC3B,kBAAkB;IAClB,UAAU;IACV,wBAAwB;CAChB,CAAA;AAEV,MAAM,8BAA8B,GAAG,8BAA8B;KAClE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAE7C,kGAAkG;AAClG,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,yBAAyB;IACzB,mCAAmC;IACnC,8BAA8B;IAC9B,mCAAmC;IACnC,gCAAgC;IAChC,iCAAiC;IACjC,wCAAwC;IACxC,mCAAmC;IACnC,+CAA+C;IAC/C,iCAAiC;IACjC,qDAAqD;IACrD,uBAAuB;IACvB,sBAAsB;CACd,CAAA;AAEV,MAAM,6BAA6B,GAAG,sCAAsC;KACzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;AAExC,MAAM,CAAC,MAAM,eAAe,GAAiD;IAC3E,KAAK,EAAE;QACL,EAAE,EAAE,OAAO;QACX,OAAO,EAAE,OAAO;QAChB,oFAAoF;QACpF,yFAAyF;QACzF,gFAAgF;QAChF,uCAAuC;QACvC,IAAI,EAAE;YACJ,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,gBAAgB;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,qDAAqD;YACrD,uBAAuB;YACvB,GAAG,8BAA8B;YACjC,GAAG,6BAA6B;YAChC,WAAW,EAAE,WAAW;SACzB;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,QAAQ;QACjB,+EAA+E;QAC/E,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,aAAa,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC;QACnL,MAAM,EAAE,QAAQ;KACjB;IACD,MAAM,EAAE;QACN,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,cAAc;QACvB,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,CAAC;QACjE,MAAM,EAAE,QAAQ;KACjB;IACD,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,OAAO,EAAE,MAAM;QACf,0EAA0E;QAC1E,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,EAAE;YACJ,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS;YACnE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY;YACzF,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,sBAAsB;SACvE;QACD,MAAM,EAAE,QAAQ;KACjB;CACF,CAAA;AAED,MAAM,UAAU,eAAe,CAC7B,QAAoB,EACpB,OAA0B,EAC1B,YAA6B,OAAO,CAAC,QAAQ;IAE7C,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,+EAA+E;IAC/E,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,eAAe,GAAG,QAAQ,KAAK,MAAM;QACzC,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,OAAO,CAAA;IACX,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAE7B,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IACrF,IAAI,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,QAAQ,KAAK,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAExC,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO;QAC1C,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,KAAK;KACb,CAAA;AACH,CAAC"}

package/lib/session-cwd.d.ts

@@ -1,4 +1,5 @@
 import { type GenerateOptions } from '@deepseek-ai/dsh-llm';
+import type { AgentLoopRequestAttestor } from '@dsh-enhanced/llm-route-capabilities';
 export interface LiveSessionCwd {
     readonly id: NonNullable<GenerateOptions['sessionId']>;
     readonly header: {
@@ -13,12 +14,13 @@ export declare class TrustedSessionCwdError extends Error {
 }
 /**
  * Resolves the only cwd a local coding process may receive for this request.
- * The marker is process-local and the session lookup is live, so copied request
- * fields or a persisted/stale session id cannot select an arbitrary directory.
+ * A same-module marker or the Host-owned exact live-agent proof is mandatory;
+ * copied request fields or a persisted/stale session id cannot select a path.
  */
 export declare function resolveTrustedSessionCwd(input: {
     request: GenerateOptions;
     configuredCwd: string;
     sessions: LiveSessionLookup | undefined;
+    attestor?: AgentLoopRequestAttestor;
 }): string;
 //# sourceMappingURL=session-cwd.d.ts.map

package/lib/session-cwd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-cwd.d.ts","sourceRoot":"","sources":["../src/session-cwd.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;IACtD,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,GAAG,cAAc,GAAG,SAAS,CAAA;CAC/E;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAIhD;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,eAAe,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAA;CACxC,GAAG,MAAM,CAaT"}
+{"version":3,"file":"session-cwd.d.ts","sourceRoot":"","sources":["../src/session-cwd.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAEpF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;IACtD,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,GAAG,cAAc,GAAG,SAAS,CAAA;CAC/E;AAED,qBAAa,sBAAuB,SAAQ,KAAK;;CAIhD;AAkBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,eAAe,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,EAAE,wBAAwB,CAAA;CACpC,GAAG,MAAM,CAsBT"}

package/lib/session-cwd.js

@@ -16,20 +16,38 @@ function canonicalDirectory(path) {
         throw new TrustedSessionCwdError();
     }
 }
+function ownEnumerableDataField(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined)
+        return undefined;
+    if (!descriptor.enumerable || !Object.hasOwn(descriptor, 'value'))
+        throw new TrustedSessionCwdError();
+    return descriptor;
+}
 /**
  * Resolves the only cwd a local coding process may receive for this request.
- * The marker is process-local and the session lookup is live, so copied request
- * fields or a persisted/stale session id cannot select an arbitrary directory.
+ * A same-module marker or the Host-owned exact live-agent proof is mandatory;
+ * copied request fields or a persisted/stale session id cannot select a path.
  */
 export function resolveTrustedSessionCwd(input) {
-    const sessionId = input.request.sessionId;
-    if (sessionId === undefined || !Object.isFrozen(input.request) || !isAgentLoopRequest(input.request)) {
+    const sessionId = ownEnumerableDataField(input.request, 'sessionId')?.value;
+    if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId.length > 512) {
         throw new TrustedSessionCwdError();
     }
     const session = input.sessions?.get(sessionId);
     if (session === undefined || session.id !== sessionId || typeof session.header.cwd !== 'string') {
         throw new TrustedSessionCwdError();
     }
+    const purpose = ownEnumerableDataField(input.request, 'purpose');
+    const hasPurpose = purpose !== undefined;
+    const loopOwned = hasPurpose
+        ? purpose.value === 'compaction'
+            && input.attestor?.claimCompaction?.(input.request, session) === true
+            && Object.isFrozen(input.request)
+        : Object.isFrozen(input.request)
+            && (isAgentLoopRequest(input.request) || input.attestor?.claim(input.request, session) === true);
+    if (!loopOwned)
+        throw new TrustedSessionCwdError();
     const configuredCwd = canonicalDirectory(input.configuredCwd);
     const sessionCwd = canonicalDirectory(session.header.cwd);
     if (configuredCwd !== sessionCwd)

package/lib/session-cwd.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-cwd.js","sourceRoot":"","sources":["../src/session-cwd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,EAAwB,MAAM,sBAAsB,CAAA;AAW/E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,wEAAwE,CAAC,CAAA;IACjF,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACzD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAIxC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAA;IACzC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzD,IAAI,aAAa,KAAK,UAAU;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpE,OAAO,UAAU,CAAA;AACnB,CAAC"}
+{"version":3,"file":"session-cwd.js","sourceRoot":"","sources":["../src/session-cwd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,EAAwB,MAAM,sBAAsB,CAAA;AAY/E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,wEAAwE,CAAC,CAAA;IACjF,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACzD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,GAAW;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC9D,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACrG,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAKxC;IACC,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,KAAqC,CAAA;IAC3G,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtF,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAChE,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAA;IACxC,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY;eAC3B,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI;eAClE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;eAC3B,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAA;IACpG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IAClD,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzD,IAAI,aAAa,KAAK,UAAU;QAAE,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpE,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/lib/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.1.3";
+export declare const version = "0.1.5";
 //# sourceMappingURL=version.d.ts.map

package/lib/version.js

@@ -1,2 +1,2 @@
-export const version = '0.1.3';
+export const version = '0.1.5';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-enhanced/coding-subscription-provider",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Use locally authenticated coding subscriptions as DeepSeek Harness model providers.",
   "license": "MIT",
   "type": "module",
@@ -48,21 +48,35 @@
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "3.18.1",
-    "@dsh-enhanced/llm-route-capabilities": "0.1.3"
+    "@dsh-enhanced/llm-route-capabilities": "0.1.5"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": ">=0.1.0-rc.8 <0.2.0",
     "@deepseek-ai/dsh-attachment": ">=0.1.0-rc.8 <0.2.0",
     "@deepseek-ai/dsh-llm": ">=0.1.0-rc.8 <0.2.0",
     "@deepseek-ai/dsh-session": ">=0.1.0-rc.8 <0.2.0"
   },
   "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-agent": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-attachment": {
       "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.8",
     "@deepseek-ai/dsh-attachment": "0.1.0-rc.8",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
     "@deepseek-ai/dsh-session": "0.1.0-rc.8",