@gilbertgt/dsh-plan-orchestrator 1.0.0

package/lib/planner-route-B9z5GziX.js

@@ -0,0 +1,101 @@
+//#region src/orchestration/failover.ts
+function eligibleTransportFailure(error) {
+	const failure = error;
+	const s = `${failure?.code ?? ""} ${failure?.failure?.code ?? ""} ${failure?.message ?? failure ?? ""}`.toLowerCase();
+	return /(timeout|rate.?limit|quota|transport|connection|network|unavailable|auth_failed|missing_credential|server|overload|503|502|504)/.test(s) && !/(cancel|abort|refusal|invalid.*schema|contract|policy|permission)/.test(s);
+}
+//#endregion
+//#region src/planning/planner-route.ts
+async function validateFixedRoute(llm, route) {
+	if (route.mode === "current") return {};
+	if (!route.provider || !route.model) throw new Error("fixed route needs provider and model");
+	const requested = {
+		provider: route.provider,
+		model: route.model,
+		...route.reasoningEffort ? { reasoningEffort: route.reasoningEffort } : {},
+		...route.maxTokens ? { maxTokens: route.maxTokens } : {}
+	};
+	if (typeof llm?.resolveCallConfig !== "function") throw new Error("DSH llm.resolveCallConfig is unavailable");
+	await llm.resolveCallConfig(requested);
+	for (const fallback of route.fallbacks) await llm.resolveCallConfig(fallback);
+	return requested;
+}
+function routeAt(route, current, index) {
+	if (index === 0) {
+		if (route.mode === "current") {
+			if (!current?.provider || !current?.model) return void 0;
+			return {
+				provider: current.provider,
+				model: current.model,
+				reasoningEffort: current.reasoningEffort,
+				maxTokens: current.maxTokens
+			};
+		}
+		return {
+			provider: route.provider,
+			model: route.model,
+			reasoningEffort: route.reasoningEffort,
+			maxTokens: route.maxTokens
+		};
+	}
+	return route.fallbacks[index - 1];
+}
+function installPlannerRoute(ctx, getRoute, isPlanActive, isEnabled = () => true) {
+	const fallbackIndex = /* @__PURE__ */ new WeakMap();
+	const request = ctx.on("agent/request", async ({ agent }, next) => {
+		const current = await next();
+		if (!isEnabled(agent) || !isPlanActive(agent)) {
+			fallbackIndex.delete(agent);
+			return current;
+		}
+		const selected = routeAt(getRoute(agent), current, fallbackIndex.get(agent) ?? 0);
+		if (!selected) return current;
+		await ctx.llm.resolveCallConfig(selected);
+		return {
+			...current,
+			provider: selected.provider,
+			model: selected.model,
+			reasoningEffort: selected.reasoningEffort,
+			maxTokens: selected.maxTokens ?? current.maxTokens
+		};
+	});
+	const assembly = ctx.on("system-prompt/assemble", async (assembled, context, next) => {
+		const result = await next();
+		const agent = context?.agent;
+		if (!agent || !isEnabled(agent) || !isPlanActive(agent)) return result;
+		const selected = routeAt(getRoute(agent), { ...agent.options }, fallbackIndex.get(agent) ?? 0);
+		if (!selected) return result;
+		return {
+			...result,
+			variables: {
+				...result.variables,
+				model: selected.model,
+				provider: selected.provider
+			}
+		};
+	});
+	const requestError = ctx.on("agent/request-error", async (payload, next) => {
+		const downstream = await next();
+		if (downstream !== void 0) return downstream;
+		const { agent, failure, signal } = payload;
+		if (signal?.aborted || !isEnabled(agent) || !isPlanActive(agent) || !eligibleTransportFailure(failure)) return void 0;
+		const route = getRoute(agent);
+		const nextIndex = (fallbackIndex.get(agent) ?? 0) + 1;
+		if (nextIndex > route.fallbacks.length) return void 0;
+		fallbackIndex.set(agent, nextIndex);
+		return { kind: "retry" };
+	});
+	const reset = ctx.on("agent/pre-step", async ({ agent }, next) => {
+		const decision = await next();
+		if (!isEnabled(agent) || !isPlanActive(agent)) fallbackIndex.delete(agent);
+		return decision;
+	});
+	return () => {
+		request?.();
+		assembly?.();
+		requestError?.();
+		reset?.();
+	};
+}
+//#endregion
+export { validateFixedRoute as n, eligibleTransportFailure as r, installPlannerRoute as t };

package/lib/publication-D352itYY.js

@@ -0,0 +1,137 @@
+import { C as git, S as fullHead, T as splitNul, a as openPrForBranch, f as assertOwnedPaths, h as atomicJson, i as ghRepository, l as assertTrustedReceipts, r as ghRaw, s as remotePr, u as receiptIndex } from "./github-Cy4Pm35G.js";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+//#region src/external/publication.ts
+function assertPublishGate(gate) {
+	if (!gate.reviewPass || !gate.validationCurrent || !gate.ownershipPass) throw new Error("publication gate requires Reviewer PASS + current validation + ownership PASS");
+}
+function assertNoForce(args) {
+	if (args.some((arg) => arg === "--force" || arg === "-f" || arg.startsWith("--force-with-lease"))) throw new Error("force push forbidden");
+}
+function completionComment(meta, pr, head) {
+	const payload = { externalCompletion: {
+		version: 1,
+		revision: meta.revision,
+		repository: meta.repository,
+		issue: meta.issueNumber,
+		pr,
+		head
+	} };
+	return [
+		"IMPLEMENTATION COMPLETE",
+		"",
+		"```json",
+		JSON.stringify(payload, null, 2),
+		"```"
+	].join("\n");
+}
+async function publishExternalRun(opts) {
+	await assertTrustedReceipts(opts.receipts, opts.expectedHead, opts.expectedOwnershipFingerprint);
+	if (await fullHead(opts.cwd) !== opts.expectedHead) throw new Error("stale HEAD before publication");
+	assertPublishGate({
+		reviewPass: true,
+		validationCurrent: true,
+		ownershipPass: true
+	});
+	if (opts.ownedPaths.length === 0) throw new Error("publication blocked: no run-owned changes");
+	await git(opts.cwd, [
+		"add",
+		"--",
+		...opts.ownedPaths
+	]);
+	const staged = splitNul((await git(opts.cwd, [
+		"diff",
+		"--cached",
+		"--name-only",
+		"-z",
+		"--"
+	])).stdout);
+	if (staged.length === 0) throw new Error("publication blocked: no staged run-owned changes");
+	assertOwnedPaths(staged, opts.ownedPaths);
+	const diff = (await git(opts.cwd, [
+		"diff",
+		"--cached",
+		"--binary",
+		"--no-ext-diff",
+		"--"
+	])).stdout;
+	const candidate = {
+		version: 1,
+		repository: opts.meta.repository,
+		issue: opts.meta.issueNumber,
+		revision: opts.meta.revision,
+		branch: opts.meta.branch,
+		expectedHead: opts.expectedHead,
+		staged,
+		stagedDiffSha256: createHash("sha256").update(diff).digest("hex"),
+		receipts: receiptIndex(opts.receipts),
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await atomicJson(join(opts.runDir, "external-issue.json"), { candidate });
+	await git(opts.cwd, [
+		"commit",
+		"-m",
+		`Implement Issue #${opts.meta.issueNumber} external plan r${opts.meta.revision}`
+	]);
+	const commit = await fullHead(opts.cwd);
+	const pushArgs = [
+		"push",
+		"origin",
+		opts.meta.branch
+	];
+	assertNoForce(pushArgs);
+	await git(opts.cwd, pushArgs);
+	let pr = await openPrForBranch(opts.cwd, opts.meta.branch);
+	if (!pr) {
+		const base = (await ghRepository(opts.cwd))?.defaultBranchRef?.name;
+		if (!base) throw new Error("default branch unavailable");
+		await ghRaw(opts.cwd, [
+			"pr",
+			"create",
+			"--base",
+			base,
+			"--head",
+			opts.meta.branch,
+			"--title",
+			`Issue #${opts.meta.issueNumber}: external plan r${opts.meta.revision}`,
+			"--body",
+			`Implements the trusted external PlanArtifact revision ${opts.meta.revision} for Issue #${opts.meta.issueNumber}.\n\nReviewer: PASS. Host validation receipts are recorded by dsh-plan-orchestrator.`
+		]);
+		pr = await openPrForBranch(opts.cwd, opts.meta.branch);
+	}
+	if (!pr?.number) throw new Error("PR create/reuse failed");
+	const prNumber = Number(pr.number);
+	const remote = await remotePr(opts.cwd, prNumber);
+	if (remote?.headRefOid !== commit) throw new Error(`remote PR head mismatch: ${remote?.headRefOid} != ${commit}`);
+	const externalCompletion = {
+		version: 1,
+		revision: opts.meta.revision,
+		repository: opts.meta.repository,
+		issue: opts.meta.issueNumber,
+		pr: prNumber,
+		head: commit
+	};
+	await ghRaw(opts.cwd, [
+		"issue",
+		"comment",
+		String(opts.meta.issueNumber),
+		"--body",
+		completionComment(opts.meta, prNumber, commit)
+	]);
+	await atomicJson(join(opts.runDir, "external-issue.json"), {
+		candidate,
+		completion: externalCompletion,
+		pr: {
+			number: prNumber,
+			url: remote?.url,
+			head: commit
+		}
+	});
+	return {
+		pr: prNumber,
+		head: commit,
+		url: remote?.url
+	};
+}
+//#endregion
+export { publishExternalRun };

package/lib/rpc-server-CGs2ndXP.js

@@ -0,0 +1,131 @@
+import { n as validateFixedRoute } from "./planner-route-B9z5GziX.js";
+//#region src/contract/rpc.ts
+const RPC_METHODS = [
+	"model-catalog",
+	"route-validate",
+	"run-list",
+	"run-detail",
+	"run-cancel",
+	"run-resume",
+	"run-cleanup",
+	"diagnostics",
+	"external-preflight"
+];
+function assertRpcBody(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("request body must be a JSON object");
+	if (Buffer.byteLength(JSON.stringify(value), "utf8") > 256 * 1024) throw new Error("request body exceeds 256KiB");
+	return value;
+}
+function boundedId(value, name) {
+	if (typeof value !== "string" || value.length < 1 || value.length > 300 || value.includes("\0")) throw new Error(`${name} invalid`);
+	return value;
+}
+//#endregion
+//#region src/model-catalog.ts
+async function modelCatalog(ctx) {
+	const providers = ctx.llm.listProviders();
+	return Promise.all(providers.map(async (p) => {
+		let models = [];
+		let error;
+		try {
+			models = await ctx.llm.listModels(p.id);
+		} catch (e) {
+			error = e.message;
+		}
+		return {
+			provider: { ...p },
+			models,
+			error
+		};
+	}));
+}
+async function routeValidate(ctx, route) {
+	return validateFixedRoute(ctx.llm, route);
+}
+//#endregion
+//#region src/rpc-server.ts
+const MAX_RESPONSE = 2 * 1024 * 1024;
+async function body(request) {
+	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw new Error("application/json required");
+	return assertRpcBody(await request.json());
+}
+function safeError(error) {
+	return String(error?.message ?? error).replace(/[A-Za-z]:\\[^\s]+|\/(?:[^\s/]+\/){2,}[^\s]*/g, "<redacted-path>").slice(0, 1e3);
+}
+function response(value, status = 200) {
+	let json = JSON.stringify(value);
+	if (Buffer.byteLength(json, "utf8") > MAX_RESPONSE) {
+		json = JSON.stringify({
+			ok: false,
+			error: {
+				code: "PLAN_ORCHESTRATOR_RESPONSE_TOO_LARGE",
+				message: "response exceeds bounded API payload"
+			}
+		});
+		status = 413;
+	}
+	return new Response(json, {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+function registerRpc(connection, deps) {
+	const disposers = [];
+	for (const method of RPC_METHODS) disposers.push(connection.fetch.register({
+		path: `/api/plan-orchestrator/${method}`,
+		methods: ["POST"],
+		requestBody: "buffered",
+		async fetch(request) {
+			try {
+				const input = await body(request);
+				let data;
+				switch (method) {
+					case "model-catalog":
+						data = await modelCatalog(deps.ctx);
+						break;
+					case "route-validate":
+						data = await routeValidate(deps.ctx, input.route);
+						break;
+					case "run-list":
+						data = deps.runList?.({ sessionId: typeof input.sessionId === "string" ? boundedId(input.sessionId, "sessionId") : void 0 }) ?? [];
+						break;
+					case "run-detail":
+						data = await deps.runDetail?.({ runId: boundedId(input.runId, "runId") });
+						break;
+					case "run-cancel":
+						data = await deps.runCancel?.({ runId: boundedId(input.runId, "runId") });
+						break;
+					case "run-resume":
+						if (deps.isEnabled && !deps.isEnabled()) throw new Error("Plan Orchestrator is disabled in Settings → Plan Mode.");
+						if (deps.canResume && !deps.canResume()) throw new Error("Safe Resume is disabled in Settings → Plan Mode.");
+						data = await deps.runResume?.({ runId: boundedId(input.runId, "runId") });
+						break;
+					case "run-cleanup":
+						data = await deps.runCleanup?.({ runId: boundedId(input.runId, "runId") });
+						break;
+					case "diagnostics":
+						data = await deps.diagnostics?.(input);
+						break;
+					case "external-preflight":
+						data = await deps.externalPreflight?.(input);
+						break;
+				}
+				return response({
+					ok: true,
+					data
+				});
+			} catch (error) {
+				return response({
+					ok: false,
+					error: {
+						code: "PLAN_ORCHESTRATOR_RPC",
+						message: safeError(error)
+					}
+				}, 400);
+			}
+		}
+	}));
+	return () => disposers.forEach((dispose) => dispose?.());
+}
+//#endregion
+export { registerRpc };

package/package.json

@@ -0,0 +1,144 @@
+{
+  "name": "@gilbertgt/dsh-plan-orchestrator",
+  "version": "1.0.0",
+  "description": "Product-grade orchestration layer for DeepSeek Harness native Plan Mode",
+  "type": "module",
+  "main": "./lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/*.js",
+    "cordis.patch.yml",
+    "compatibility.json",
+    "profiles/*.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "test": "node --experimental-strip-types --test test/unit/*.test.mjs test/integration/*.test.mjs",
+    "test:unit": "node --experimental-strip-types --test test/unit/*.test.mjs",
+    "test:integration": "node --experimental-strip-types --test test/integration/*.test.mjs",
+    "test:platform": "node --experimental-strip-types --test test/platform/*.test.mjs test/integration/*.test.mjs",
+    "typecheck": "tsc --noEmit",
+    "build": "tsdown --config tsdown.config.mjs",
+    "pack:check": "node scripts/pack-check.mjs",
+    "compat:check": "node scripts/compatibility.mjs",
+    "check": "npm test && npm run typecheck && npm run build && npm run pack:check && npm run compat:check",
+    "e2e:rc1": "node scripts/e2e-rc1.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "node scripts/direct-publish-guard.mjs",
+    "release:source": "node scripts/release-source-check.mjs",
+    "release:pack": "node scripts/release-pack.mjs"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "4.0.1 || 4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-plan-mode": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.1"
+  },
+  "optionalDependencies": {
+    "@deepseek-ai/dsh-sdk-client": "0.1.5-rc.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-plan-mode": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sdk-client": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sdk-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-questions": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.1",
+    "@deepseek-ai/schemastery": "3.18.2",
+    "@types/node": "^22.20.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "pnpm": "12.4.1",
+    "tsdown": "0.22.2",
+    "typescript": "^5.9.0"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gilbertgt/DSH-plan-mode.git"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "overrides": {
+    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-sdk-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-user-questions": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.1"
+  }
+}

package/profiles/reviewer.cordis.yml

@@ -0,0 +1,5 @@
+# Overlay for a dedicated SDK Reviewer fallback. Reviewer work is strictly
+# read-only; the host also scopes visible tools so this is defense in depth.
+- id: sandbox-policy
+  config:
+    mode: read-only

package/profiles/worker.cordis.yml

@@ -0,0 +1,5 @@
+# Overlay for worktree-isolated SDK Workers. The sdk profile already composes
+# dsh-base; this file only tightens the per-session filesystem policy.
+- id: sandbox-policy
+  config:
+    mode: workspace-write