@itookit/dsht 0.5.1 → 0.5.2

package/README.i18n.yaml

@@ -1,3 +1,3 @@
 # Git blob hashes of the reviewed bilingual pair.
-README.md: 4909b6c278281d0f17a4140287c3c09372c1644e
-README.zh.md: f515831f168100fd7c85d8441dfd471c8cefb075
+README.md: 02d559e19c88336d6eb1f1e1ff80999bbfaa7274
+README.zh.md: b962a44f8a85716f4bd35f8afd0af7d140ffe0ca

package/README.md

@@ -398,6 +398,8 @@ Closed `mermaid` fences render as Unicode diagrams for supported flowcharts, sta
 
 `/export-html [local.html]` saves the currently loaded conversation and live tail with Mermaid SVG images and MathJax-generated MathML. Open the file in a browser for full mathematical layout; no network or scripts are required. Older or evicted messages are excluded, and tool rows remain summaries. The default filename is timestamped in the working directory; quoted paths are accepted, existing files are never overwritten, and cancellation removes incomplete output. `/export` remains the complete host-log ZIP download.
 
+While disconnected, you can keep editing your draft and save, edit, or delete local shortcut prompts. Host operations report that the connection is unavailable and retain the draft. Reconnecting refreshes data and restores subscriptions while preserving the selected conversation, picker filter, or host-path screen; it never automatically submits an unsent draft.
+
 ## Live status
 
 The footer groups `◐ Working · 8s · Ctrl+C Stop`, `● Ready`, or `? Needs you` while this client still owes an approval or an answer, model and reasoning effort, the session cost beside today's spend with the all-time total, a ten-cell context bar and percentage, and session turns / total tokens / cache-hit share. Wide terminals reserve the activity column so model and metrics stay aligned when a run completes. Narrow terminals reclaim padding, remove the bar, shorten the model, and then omit lower-priority metrics while retaining the stop hint. `/status` shows the host URL, operation status, workspace path, full provider/model, pending model, usage buckets, turns, queues, jobs, and four-decimal costs. `!` flags a metrics or model catalog error, or incomplete cost coverage; details explain the cause. Running sessions use the last-used model; ready sessions use the next selection, with the host catalog default for new sessions. Model catalog changes refresh on host settings, credential, and adapter notifications.
@@ -436,7 +438,7 @@ Usage files live under `~/.local/state/dsht/cost/<origin-hash>/` (respecting `XD
 
 ## Client API
 
-Installed packages export `Client` from `@itookit/dsht` and `login`/`CookieStore` from `@itookit/dsht/auth`, with TypeScript declarations. Source consumers can import from `src/transport/client.ts` with a TypeScript loader, or from `dist/index.js` after building. `authenticate(token)` exchanges credentials; `connect()` opens one multiplexed socket; `listWorkspaces()` and `listSessions(workspaceId?)` return promises of server rows. `call(endpoint, args, signal?)` preserves host errors as `RemoteError` with `code` and `details`. Always await `close()` in `finally`. Library consumers opt into persistence with `login(client, token, new CookieStore())` from `src/transport/auth.ts`; `Client.authenticate()` itself only retains credentials in memory.
+Installed packages export `Client` from `@itookit/dsht` and `login`/`CookieStore` from `@itookit/dsht/auth`, with TypeScript declarations. Source consumers can import from `src/transport/client.ts` with a TypeScript loader, or from `dist/index.js` after building. `authenticate(token)` exchanges credentials; `connect()` opens one multiplexed socket; `listWorkspaces(signal?)` and `listSessions(workspaceId?, signal?)` return promises of server rows. `call(endpoint, args, signal?)` preserves host errors as `RemoteError` with `code` and `details`. Always await `close()` in `finally`; concurrent calls share completion. Closing permanently ends that client, so create a new `Client` for a new lifetime. A peer disconnect without `close()` allows `connect()` again with the retained cookie. Library consumers opt into persistence with `login(client, token, new CookieStore())` from `src/transport/auth.ts`; `Client.authenticate()` itself only retains credentials in memory.
 
 Session and workspace command methods use `{ request: { ... } }` inside `args`; session listing uses `{ _request: {} }`. `$events/result` uses its named arguments directly. Follow snapshots replace retained state after reconnect; durable messages and transient assistant text remain separate. The reader accepts both `event` records and older `chunks` wrappers containing `chunkrow/text-chunks`, `chunkrow/reasoning-chunks`, or `chunkrow/tool-call-chunks`. Hosts without `assistantStream` expose live text through logged chunks; the TUI reconstructs only the unfinished attempt and preserves each packed record's starting sequence for pagination.
 
@@ -484,7 +486,7 @@ node dist/cli/index.js --help
 
 Tests use isolated HTTP/WebSocket hosts, drive the real Ink picker and composer, run the CLI in subprocesses, and project copied Harness v2 workspace-edit and v0 packed-chunk recordings. The repository needs no model credentials for these checks. The recording and expected transcript live under `tests/`; they do not depend on a parent checkout. Live model-provider behavior is not covered by these tests.
 
-Source is organised by business domain under `src/`: `transport/` owns the host wire protocol and normalizes host frames into semantic events, `session/` the transcript, history, interactions and the session runtime, `cost/` the billing ledger, `catalog/` models and presets, `shell/` local `!` commands, `controller/` the application facade and event routing, `slash/` the command syntax, `ui/` everything React and Ink, `storage/` every filesystem operation, `cli/` the composition root, and the root files (`state.ts`, `json.ts`, `text.ts`, `contracts.ts`, `session-title.ts`, `references.ts`) the shared contracts. Cross-domain imports go through each module's `index.ts` or a shared leaf, and `tests/architecture/dependencies.test.ts` enforces nine forbidden directions with no exemptions.
+Source is organised by business domain under `src/`: `transport/` owns the host wire protocol and normalizes host frames into semantic events, `session/` the transcript, history, interactions and the session runtime, `cost/` the billing ledger, `catalog/` models and presets, `shell/` local `!` commands, `controller/` the application facade and event routing, `slash/` the command syntax, `ui/` everything React and Ink, `storage/` every filesystem operation, `cli/` the composition root, and the root files (`state.ts`, `json.ts`, `text.ts`, `contracts.ts`, `session-title.ts`, `references.ts`) the shared contracts. Internal cross-domain imports follow the allowed dependency directions, using a domain entry point or a specific module. UI leaves read domain types through `contracts.ts`. The TypeScript syntax check in `tests/architecture/dependencies.test.ts` enforces nine forbidden directions, type-only contracts, resolvable literal module targets, and the absence of dependency cycles, including type edges.
 
 `npm test` renders frames without styling, because the assertions and the recorded expectations in `tests/expected/` describe text. A test runner started from a terminal exports `FORCE_COLOR=1` to each test file, which makes Ink interleave SGR escapes between a prompt and its text; `npm run test:terminal` reproduces that environment on any host, and `prepublishOnly` runs it so a publish from a terminal validates what a terminal actually renders. Theme tests render separate truecolor and plain subprocesses with terminal and CI color detection isolated from the parent environment.
 

package/README.zh.md

@@ -279,8 +279,8 @@ npx @itookit/dsht list sessions --workspace WORKSPACE_ID --json
 ```sh
 npm start -- list workspaces --json
 npm start -- list sessions --json
-node --import tsx src/cli/index.tsx list workspaces --json
-node --import tsx src/cli/index.tsx list sessions --json
+node --import tsx src/cli/index.ts list workspaces --json
+node --import tsx src/cli/index.ts list sessions --json
 ```
 
 JSON 输出格式为 `{ "items": [...] }`；省略 `--json` 则输出制表符分隔的列表。工作区筛选使用服务端 `sessionIds` 成员关系。工作区列表读取 `workspace/follow` 的首个 baseline 后取消订阅，不会调用不存在的 `workspace/list` 端点。
@@ -398,6 +398,8 @@ Slash 命令在选择器和对话输入框中均可使用。输入 `/` 会显示
 
 `/export-html [local.html]` 将当前已加载会话和实时尾部保存为包含 Mermaid SVG 图片及 MathJax 生成的 MathML 的页面。用浏览器打开文件可查看完整数学排版，不需要网络或脚本。尚未加载或已回收的消息不包含在内，工具行仍为摘要。默认文件名带时间戳并保存在当前工作目录，支持带引号的路径，不覆盖已有文件，取消时删除未完成输出。`/export` 仍下载服务端完整日志 ZIP。
 
+断线期间仍可编辑草稿，保存、编辑或删除本地快捷提示词。需要服务端的操作会报告未连接并保留草稿。重连只刷新数据和恢复订阅，保留当前会话、选择器筛选或路径输入页面，不会自动发送未提交的草稿。
+
 ## 实时状态
 
 底栏分组显示 `◐ Working · 8s · Ctrl+C Stop`、`● Ready`，或本客户端还欠一个审批／回答时的 `? Needs you`、模型与思考强度、本会话费用与「今天花费（历史总计）」、十格上下文进度条及百分比、会话轮次与累计 token 及缓存命中率。宽终端为运行状态预留固定宽度，完成后模型和指标保持对齐。窄终端依次回收留白、隐藏进度条、缩短模型名、省略次要指标，优先保留停止提示。`/status` 显示主机 URL、操作状态、工作区完整路径、完整供应商／模型、下次模型、各项用量、轮次、队列、后台任务和四位小数费用。`!` 表示有指标或模型目录错误，或计费覆盖不完整；详情中显示原因。运行中使用最近实际使用的模型，空闲时使用下次模型，新会话使用服务端模型目录默认值。服务端设置、凭据和适配器变更通知会刷新模型目录。
@@ -436,7 +438,7 @@ Slash 命令在选择器和对话输入框中均可使用。输入 `/` 会显示
 
 ## 客户端接口
 
-安装后的包通过 `@itookit/dsht` 导出 `Client`，通过 `@itookit/dsht/auth` 导出 `login`／`CookieStore`，并提供 TypeScript 声明。源码调用方可通过 TypeScript loader 从 `src/transport/client.ts` 导入，或构建后从 `dist/index.js` 导入。`authenticate(token)` 兑换凭据；`connect()` 打开一条多路复用连接；`listWorkspaces()` 和 `listSessions(workspaceId?)` 返回服务端列表的 Promise。`call(endpoint, args, signal?)` 将服务端错误保留为带有 `code` 和 `details` 的 `RemoteError`。务必在 `finally` 中等待 `close()`。库调用方可使用 `src/transport/auth.ts` 的 `login(client, token, new CookieStore())` 启用持久化；`Client.authenticate()` 本身仅在内存中保留凭据。
+安装后的包通过 `@itookit/dsht` 导出 `Client`，通过 `@itookit/dsht/auth` 导出 `login`／`CookieStore`，并提供 TypeScript 声明。源码调用方可通过 TypeScript loader 从 `src/transport/client.ts` 导入，或构建后从 `dist/index.js` 导入。`authenticate(token)` 兑换凭据；`connect()` 打开一条多路复用连接；`listWorkspaces(signal?)` 和 `listSessions(workspaceId?, signal?)` 返回服务端列表的 Promise。`call(endpoint, args, signal?)` 将服务端错误保留为带有 `code` 和 `details` 的 `RemoteError`。务必在 `finally` 中等待 `close()`；并发调用等待同一次关闭完成。关闭会永久结束该客户端，下一次使用需新建 `Client`。若只是对端断线而未调用 `close()`，可保留 Cookie 再次 `connect()`。库调用方可使用 `src/transport/auth.ts` 的 `login(client, token, new CookieStore())` 启用持久化；`Client.authenticate()` 本身仅在内存中保留凭据。
 
 会话和工作区命令在 `args` 内使用 `{ request: { ... } }`；会话列表使用 `{ _request: {} }`。`$events/result` 直接使用具名参数。重连后的 follow 快照整体替换保留状态；持久消息与临时助手文本分别保存。读取器同时支持 `event` 记录和旧版 `chunks` 包装；后者包含 `chunkrow/text-chunks`、`chunkrow/reasoning-chunks` 或 `chunkrow/tool-call-chunks`。不提供 `assistantStream` 的服务端通过日志 chunk 传递实时文本；TUI 只重建尚未完成的尝试，并保留每条压缩记录的起始序号用于翻页。
 
@@ -484,7 +486,7 @@ node dist/cli/index.js --help
 
 测试使用隔离的 HTTP/WebSocket 服务，驱动实际 Ink 选择器和输入框，在子进程中运行 CLI，并投影复制的 Harness v2 工作区编辑记录和 v0 压缩 chunk 记录。这些检查不需要模型凭据。记录和预期对话输出位于 `tests/`，不依赖父仓库。测试不覆盖真实模型供应商行为。
 
-源码在 `src/` 下按业务域组织：`transport/` 负责服务端 wire 协议并把宿主帧归一化为语义事件，`session/` 负责对话、历史、交互与会话运行态，`cost/` 负责计费账本，`catalog/` 负责模型与 preset，`shell/` 负责本地 `!` 命令，`controller/` 是应用门面与事件路由，`slash/` 负责命令语法，`ui/` 承载全部 React 与 Ink，`storage/` 负责全部文件系统操作，`cli/` 是组装入口，根文件（`state.ts`、`json.ts`、`text.ts`、`contracts.ts`、`session-title.ts`、`references.ts`）是共享契约。跨模块导入统一走各模块的 `index.ts` 或共享叶子，`tests/architecture/dependencies.test.ts` 以九条无豁免的禁止方向强制这些边界。
+源码在 `src/` 下按业务域组织：`transport/` 负责服务端 wire 协议并把宿主帧归一化为语义事件，`session/` 负责对话、历史、交互与会话运行态，`cost/` 负责计费账本，`catalog/` 负责模型与 preset，`shell/` 负责本地 `!` 命令，`controller/` 是应用门面与事件路由，`slash/` 负责命令语法，`ui/` 承载全部 React 与 Ink，`storage/` 负责全部文件系统操作，`cli/` 是组装入口，根文件（`state.ts`、`json.ts`、`text.ts`、`contracts.ts`、`session-title.ts`、`references.ts`）是共享契约。内部跨域导入沿允许的依赖方向，可使用域入口或具体模块；UI 叶子组件通过 `contracts.ts` 读取领域类型。`tests/architecture/dependencies.test.ts` 使用 TypeScript 语法解析，检查九条禁止方向、纯类型契约、可解析的字面量模块路径，以及包含类型边在内的无环依赖。
 
 `npm test` 渲染不带样式的帧，因为断言和 `tests/expected/` 中的预期输出描述的是文本。从终端启动的测试运行器会向每个测试文件导出 `FORCE_COLOR=1`，使 Ink 在提示符与文本之间插入 SGR 转义序列；`npm run test:terminal` 在任何主机上复现该环境，`prepublishOnly` 也会运行它，因此从终端发布时验证的就是终端实际渲染的结果。 主题测试在独立子进程中分别渲染真彩色和纯文本，并隔离父进程中影响终端和 CI 颜色检测的环境设置。
 

package/dist/catalog/controller.d.ts

@@ -1,32 +1,52 @@
 import type { HostAccess } from '../transport/host.ts';
 import { type ObjectValue } from '../transport/wire.ts';
-import type { ControllerStore } from '../state.ts';
+/** Catalog can publish its metadata and selection result, but cannot navigate or mutate sessions. */
+export interface CatalogUpdate {
+    defaultModel?: ObjectValue;
+    modelError?: string;
+    presets?: ObjectValue[];
+    presetError?: string;
+    status?: string;
+}
+export interface CatalogHost extends HostAccess {
+    selection(): {
+        revision: number;
+        sessionId: string | undefined;
+    };
+    publish(patch: CatalogUpdate): void;
+}
 /** Owns model-catalog and preset loads for the selected session. */
 export declare class CatalogController {
-    private readonly store;
     private readonly host;
     private presetClient?;
     private revision;
+    private generation;
+    private refreshAbort?;
     private tasks;
-    constructor(store: ControllerStore, host: HostAccess);
+    constructor(host: CatalogHost);
     /** Drop generation-scoped catalog state at the start of a connection generation. */
     reset(): void;
+    /** Stop catalog requests before waiting for transport shutdown. Reset opens the next generation. */
+    close(): void;
     /** Wait for every in-flight catalog task, so shutdown leaves no pending request. */
     settle(): Promise<void>;
+    private track;
+    private signal;
     /** Load the optional preset roster once per connection, only when a session names a preset. */
     loadPresetNames(): void;
     /** Fetch current model routes and adapter-owned reasoning choices for the selected session.
      * @returns Host catalog; provider failures remain available to the selector.
      */
-    modelCatalog(): Promise<ObjectValue>;
+    modelCatalog(caller?: AbortSignal): Promise<ObjectValue>;
     /** Select the next request's model; the host also attempts to save its deployment default.
      * @param provider - Host provider route ID.
      * @param model - Exact model ID.
      * @param reasoningEffort - Optional adapter-owned effort ID; omission uses its default.
      */
-    selectModel(provider: string, model: string, reasoningEffort?: string): Promise<void>;
+    selectModel(provider: string, model: string, reasoningEffort?: string, caller?: AbortSignal): Promise<void>;
     /** Reload the default route and provider failures without touching session state. */
     refresh(): void;
     /** @returns The selected session identity, or a `Select a session first` failure. */
-    private get sessionId();
+    private selected;
+    private isSelected;
 }

package/dist/catalog/controller.js

@@ -1,88 +1,116 @@
 import { array, errorText, object, string } from "../transport/wire.js";
 /** Owns model-catalog and preset loads for the selected session. */
 export class CatalogController {
-    store;
     host;
     presetClient;
     revision = 0;
+    generation = new AbortController();
+    refreshAbort;
     tasks = new Set();
-    constructor(store, host) {
-        this.store = store;
+    constructor(host) {
         this.host = host;
     }
     /** Drop generation-scoped catalog state at the start of a connection generation. */
     reset() {
-        this.store.update({ modelError: undefined, defaultModel: undefined, presets: undefined, presetError: undefined });
+        this.close();
+        this.generation = new AbortController();
+        this.presetClient = undefined;
+        this.host.publish({ modelError: undefined, defaultModel: undefined, presets: undefined, presetError: undefined });
     }
+    /** Stop catalog requests before waiting for transport shutdown. Reset opens the next generation. */
+    close() { this.revision++; this.generation.abort(); }
     /** Wait for every in-flight catalog task, so shutdown leaves no pending request. */
-    async settle() { await Promise.all(this.tasks); }
+    async settle() { await Promise.allSettled(this.tasks); }
+    track(task) {
+        this.tasks.add(task);
+        void task.then(() => this.tasks.delete(task), () => this.tasks.delete(task));
+        return task;
+    }
+    signal(caller = this.host.signal()) {
+        return AbortSignal.any([caller, this.host.signal(), this.generation.signal]);
+    }
     /** Load the optional preset roster once per connection, only when a session names a preset. */
     loadPresetNames() {
         const client = this.host.client();
-        if (!client || !this.store.state.online || this.presetClient === client)
+        const signal = this.signal();
+        if (!client || !this.host.online() || this.presetClient === client || signal.aborted)
             return;
         this.presetClient = client;
-        const task = client.call('agentPresets/list', {}).then(value => {
-            if (client === this.host.client())
-                this.store.update({ presets: array(object(value).presets).map(object), presetError: undefined });
+        const current = () => !signal.aborted && client === this.host.client();
+        const task = client.call('agentPresets/list', {}, signal).then(value => {
+            if (current())
+                this.host.publish({ presets: array(object(value).presets).map(object), presetError: undefined });
         }).catch(error => {
-            if (client === this.host.client())
-                this.store.update({ presets: [], presetError: errorText(error) });
+            if (current())
+                this.host.publish({ presets: [], presetError: errorText(error) });
         });
-        this.tasks.add(task);
-        void task.finally(() => this.tasks.delete(task));
+        this.track(task);
     }
     /** Fetch current model routes and adapter-owned reasoning choices for the selected session.
      * @returns Host catalog; provider failures remain available to the selector.
      */
-    async modelCatalog() {
-        const sessionId = this.sessionId;
-        const selection = this.store.selection();
-        const value = object(await this.host.require().call('session/modelCatalog', {}));
-        if (selection !== this.store.selection() || sessionId !== this.store.state.sessionId)
-            throw new Error('Session changed while loading models');
-        return value;
+    async modelCatalog(caller) {
+        const selection = this.selected();
+        const signal = this.signal(caller);
+        signal.throwIfAborted();
+        return this.track((async () => {
+            const value = object(await this.host.require().call('session/modelCatalog', {}, signal));
+            signal.throwIfAborted();
+            if (!this.isSelected(selection))
+                throw new Error('Session changed while loading models');
+            return value;
+        })());
     }
     /** Select the next request's model; the host also attempts to save its deployment default.
      * @param provider - Host provider route ID.
      * @param model - Exact model ID.
      * @param reasoningEffort - Optional adapter-owned effort ID; omission uses its default.
      */
-    async selectModel(provider, model, reasoningEffort) {
-        const sessionId = this.sessionId;
-        const selection = this.store.selection();
-        const selected = object(object(await this.host.require().call('session/selectModel', { request: {
-                sessionId, provider, model, ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
-            } })).selected);
-        if (selection !== this.store.selection() || sessionId !== this.store.state.sessionId)
-            return;
-        this.store.update({ status: `Next request: ${string(selected.provider)} / ${string(selected.model)}${selected.reasoningEffort ? ` · ${string(selected.reasoningEffort)}` : ''}` });
-        this.refresh();
+    async selectModel(provider, model, reasoningEffort, caller) {
+        const selection = this.selected();
+        const signal = this.signal(caller);
+        signal.throwIfAborted();
+        await this.track((async () => {
+            const selected = object(object(await this.host.require().call('session/selectModel', { request: {
+                    sessionId: selection.sessionId, provider, model, ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
+                } }, signal)).selected);
+            signal.throwIfAborted();
+            if (!this.isSelected(selection))
+                return;
+            this.host.publish({ status: `Next request: ${string(selected.provider)} / ${string(selected.model)}${selected.reasoningEffort ? ` · ${string(selected.reasoningEffort)}` : ''}` });
+            this.refresh();
+        })());
     }
     /** Reload the default route and provider failures without touching session state. */
     refresh() {
         const client = this.host.client();
-        if (!client)
+        if (!client || !this.host.online())
+            return;
+        this.refreshAbort?.abort();
+        this.refreshAbort = new AbortController();
+        const signal = this.signal(this.refreshAbort.signal);
+        if (signal.aborted)
             return;
         const revision = ++this.revision;
-        const task = client.call('session/modelCatalog', {}).then(value => {
-            if (client === this.host.client() && revision === this.revision)
-                this.store.update({ defaultModel: object(object(value).default), modelError: undefined });
-        }, error => {
-            if (client === this.host.client() && revision === this.revision)
-                this.store.update({ defaultModel: undefined, modelError: errorText(error) });
+        const current = () => !signal.aborted && client === this.host.client() && revision === this.revision;
+        const task = client.call('session/modelCatalog', {}, signal).then(value => {
+            if (current())
+                this.host.publish({ defaultModel: object(object(value).default), modelError: undefined });
         }).catch(error => {
-            if (client === this.host.client() && revision === this.revision)
-                this.store.update({ defaultModel: undefined, modelError: errorText(error) });
+            if (current())
+                this.host.publish({ defaultModel: undefined, modelError: errorText(error) });
         });
-        this.tasks.add(task);
-        void task.finally(() => this.tasks.delete(task));
+        this.track(task);
     }
     /** @returns The selected session identity, or a `Select a session first` failure. */
-    get sessionId() {
-        const id = this.store.state.sessionId;
-        if (!id)
+    selected() {
+        const selected = this.host.selection();
+        if (!selected.sessionId)
             throw new Error('Select a session first');
-        return id;
+        return { ...selected, sessionId: selected.sessionId };
+    }
+    isSelected(selection) {
+        const current = this.host.selection();
+        return current.revision === selection.revision && current.sessionId === selection.sessionId;
     }
 }

package/dist/catalog/index.d.ts

@@ -1,2 +1,3 @@
 /** Catalog domain: model routes, reasoning efforts and agent-preset metadata. */
 export { CatalogController } from './controller.ts';
+export type { CatalogHost, CatalogUpdate } from './controller.ts';

package/dist/cli/dsht.js

@@ -168,7 +168,10 @@ async function main() {
         cwd: localDirectory, env: process.env,
         timeoutMs: verifyTimeoutMs(process.env.DSHT_VERIFY_TIMEOUT_MS),
         createSession: (title) => controller.actions.createVerifierSession(title),
-        cancelSession: async (sessionId) => { await controller.actions.cancelVerifierSession(sessionId); },
+        cancelSession: async (sessionId) => {
+            if (!await controller.actions.cancelVerifierSession(sessionId))
+                throw new Error('Verifier cancellation was not accepted');
+        },
         onLine: line => { if (values.headless)
             log(line); },
         // Off by default: a verifier reason reaches the progress line and the trace, and that log may be

package/dist/cli/startup.js

@@ -7,6 +7,7 @@
 import { runCommand } from "../controller/index.js";
 import { errorText } from "../transport/wire.js";
 import { dirname } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
 import { ensureDirectory, renameFile, writePrivateFile } from "../storage/index.js";
 import { latestAssistantText } from "../controller/loop.js";
 import { parseVerdict } from "../controller/loop-contract.js";
@@ -26,12 +27,15 @@ const VERDICT_POLL_MS = 200;
  * @param what - Human-readable subject for the timeout message.
  * @param timeoutMs - Longest wait.
  */
-async function until(condition, what, timeoutMs = STEP_TIMEOUT_MS) {
+async function until(signal, condition, what, timeoutMs = STEP_TIMEOUT_MS) {
     const deadline = Date.now() + timeoutMs;
-    while (!condition()) {
+    for (;;) {
+        signal.throwIfAborted();
+        if (condition())
+            return;
         if (Date.now() >= deadline)
             throw new Error(`Timed out waiting for ${what}`);
-        await new Promise(resolve => setTimeout(resolve, POLL_MS));
+        await delay(POLL_MS, undefined, { signal });
     }
 }
 /** Run the plan against a started controller.
@@ -41,9 +45,10 @@ async function until(condition, what, timeoutMs = STEP_TIMEOUT_MS) {
  * @returns Whether a started loop passed, nothing ran, or the run failed.
  */
 export async function runStartup(controller, plan, log) {
+    const signal = controller.connection.signal();
     // `online` alone is too early: the startup picker runs after it and would overwrite a selection
     // made here, which is exactly how a forked verifier used to lose its session.
-    await until(() => controller.state.online && controller.queries.connectionSettled, 'the host connection');
+    await until(signal, () => controller.state.online && controller.queries.connectionSettled, 'the host connection');
     if (plan.workspace !== undefined && !await controller.actions.switchWorkspace(plan.workspace)) {
         throw new Error(`Workspace not found: ${plan.workspace}`);
     }
@@ -60,12 +65,13 @@ export async function runStartup(controller, plan, log) {
     }
     // A selected session is not sendable until its follow snapshot lands.
     if (plan.commands.length) {
-        await until(() => controller.state.screen === 'chat' && controller.state.sessionId !== undefined && controller.queries.record.ready, 'the session snapshot');
+        await until(signal, () => controller.state.screen === 'chat' && controller.state.sessionId !== undefined && controller.queries.record.ready, 'the session snapshot');
     }
     // Start-up lines are one-shot action commands; the cancellable port is only used by searches
     // and exports, which have no meaning before the operator is present.
     const port = { run: (_label, operation) => operation(controller.connection.signal()) };
     for (const line of plan.commands) {
+        signal.throwIfAborted();
         // The scripted half runs the same two stages the composer does after `interpret`: a headless
         // caller has no menus or screens, but it has every application fact `normalize`/`authorize` read.
         const command = normalize({ kind: 'line', line }, {
@@ -100,14 +106,19 @@ export async function runStartup(controller, plan, log) {
         // Sending a prompt needs the follow snapshot, and a verifier starts the instant a busy turn ends,
         // so this wait is longer than a normal startup step: the host can be slow to open the new stream.
         try {
-            await until(() => controller.state.sessionId !== undefined && controller.queries.record.ready, 'the verifier session snapshot', PROMPT_SNAPSHOT_TIMEOUT_MS);
+            await until(signal, () => controller.state.sessionId !== undefined && controller.queries.record.ready, 'the verifier session snapshot', PROMPT_SNAPSHOT_TIMEOUT_MS);
         }
         catch (error) {
+            signal.throwIfAborted();
             // Which of the three conditions failed is the whole diagnosis, so it travels with the error.
             throw new Error(`${errorText(error)} (screen=${controller.state.screen}, session=${controller.state.sessionId ?? 'none'},`
                 + ` snapshot=${String(controller.queries.record.ready)}, online=${String(controller.state.online)})`);
         }
-        await controller.actions.prompt(plan.prompt);
+        if (!await controller.actions.prompt(plan.prompt)) {
+            signal.throwIfAborted();
+            const reason = controller.state.lastFailure;
+            throw new Error(`Prompt was not accepted${reason ? ` (${reason})` : ''}`);
+        }
     }
     if (controller.queries.loop !== undefined)
         return await waitForLoop(controller, plan.timeoutSeconds * 1000, log);
@@ -129,8 +140,10 @@ export async function runStartup(controller, plan, log) {
  * @returns The verdict once the line may run, or the refusal it will never outlive.
  */
 async function authorizeWhenReady(controller, command) {
+    const signal = controller.connection.signal();
     const deadline = Date.now() + STEP_TIMEOUT_MS;
     for (;;) {
+        signal.throwIfAborted();
         const verdict = authorize(command, {
             sessionSelected: controller.state.sessionId !== undefined,
             pending: controller.state.pending.length > 0,
@@ -141,7 +154,7 @@ async function authorizeWhenReady(controller, command) {
             return verdict;
         if (Date.now() >= deadline)
             throw new Error(`Timed out waiting for the client to be free: ${command.kind}`);
-        await new Promise(resolve => setTimeout(resolve, POLL_MS));
+        await delay(POLL_MS, undefined, { signal });
     }
 }
 /** Persist the verdict this session's reply just produced.
@@ -157,6 +170,8 @@ async function authorizeWhenReady(controller, command) {
  * @param log - Progress sink.
  */
 async function writeVerdict(controller, target, repliesBefore, log) {
+    const signal = controller.connection.signal();
+    signal.throwIfAborted();
     const [, kind = '', step = '', attempt = ''] = target.identity.split('/');
     const expect = { verificationId: target.identity, kind, step: Number(step), attempt: Number(attempt) };
     // The host reports the turn idle just before that reply is committed, so an immediate parse can
@@ -169,7 +184,7 @@ async function writeVerdict(controller, target, repliesBefore, log) {
     let parsed = replyArrived() ? parseVerdict(latestAssistantText(controller.queries.record.messages), expect) : undefined;
     const deadline = Date.now() + VERDICT_GRACE_MS;
     while (parsed === undefined && Date.now() < deadline) {
-        await new Promise(resolve => setTimeout(resolve, VERDICT_POLL_MS));
+        await delay(VERDICT_POLL_MS, undefined, { signal });
         if (replyArrived())
             parsed = parseVerdict(latestAssistantText(controller.queries.record.messages), expect);
     }
@@ -209,8 +224,10 @@ async function writeVerdict(controller, target, repliesBefore, log) {
  * @returns `idle` when the turn ended, `failed` on timeout.
  */
 async function waitForTurn(controller, finishedBefore, timeoutMs, log) {
+    const signal = controller.connection.signal();
     const deadline = Date.now() + timeoutMs;
     for (;;) {
+        signal.throwIfAborted();
         if (controller.queries.turnsCompleted > finishedBefore) {
             log('Turn finished');
             return 'idle';
@@ -226,7 +243,7 @@ async function waitForTurn(controller, finishedBefore, timeoutMs, log) {
             log('Turn timed out');
             return 'failed';
         }
-        await new Promise(resolve => setTimeout(resolve, POLL_MS));
+        await delay(POLL_MS, undefined, { signal });
     }
 }
 /** The host interaction this client cannot answer itself, when one is pending.
@@ -257,9 +274,11 @@ async function ensureWorkspace(controller, log) {
  * @returns `passed` when the loop met its threshold, `failed` otherwise.
  */
 async function waitForLoop(controller, timeoutMs, log) {
+    const signal = controller.connection.signal();
     const deadline = Date.now() + timeoutMs;
     let previous = '';
     for (;;) {
+        signal.throwIfAborted();
         const progress = controller.queries.loop;
         if (progress === undefined || progress.phase !== 'running') {
             // A cancelled loop usually means the connection ended; say so, or the exit code is a mystery.
@@ -290,6 +309,6 @@ async function waitForLoop(controller, timeoutMs, log) {
             log('Loop timed out and was stopped');
             return 'failed';
         }
-        await new Promise(resolve => setTimeout(resolve, POLL_MS));
+        await delay(POLL_MS, undefined, { signal });
     }
 }

package/dist/cli/verifier.d.ts

@@ -51,10 +51,14 @@ export declare class ProcessVerifier implements VerifierPort {
     private readonly options;
     /** This client forks itself, so the harness that judges is this one. */
     readonly name = "dsht";
+    private readonly tasks;
     constructor(options: ProcessVerifierOptions);
     /** @param request - Round identity, prompt and verdict path.
      *  @param signal - Cancels the child; the run also stops at its own deadline.
      *  @returns The verdict read back from the file, or a note explaining its absence.
      */
     verify(request: VerifierRequest, signal: AbortSignal): Promise<VerifierOutcome>;
+    /** Keep host cancellation available until every child has completed its bounded cleanup. */
+    settle(): Promise<void>;
+    private runVerification;
 }

package/dist/cli/verifier.js

@@ -66,6 +66,7 @@ export class ProcessVerifier {
     options;
     /** This client forks itself, so the harness that judges is this one. */
     name = 'dsht';
+    tasks = new Set();
     constructor(options) {
         this.options = options;
     }
@@ -74,6 +75,18 @@ export class ProcessVerifier {
      *  @returns The verdict read back from the file, or a note explaining its absence.
      */
     async verify(request, signal) {
+        const task = this.runVerification(request, signal);
+        this.tasks.add(task);
+        try {
+            return await task;
+        }
+        finally {
+            this.tasks.delete(task);
+        }
+    }
+    /** Keep host cancellation available until every child has completed its bounded cleanup. */
+    async settle() { await Promise.allSettled([...this.tasks]); }
+    async runVerification(request, signal) {
         const run = this.options.run ?? runProcess;
         const file = request.file;
         // Cancelled before anything happened: no session, no child, no verdict file.
@@ -125,10 +138,18 @@ export class ProcessVerifier {
                     ? { note: 'host cannot cancel', stopped: false }
                     : { note: 'no verifier session to cancel', stopped: true };
             }
-            const settled = await Promise.race([
-                confirmation.then(() => true),
-                new Promise(resolve => { const wait = setTimeout(() => resolve(false), CANCEL_CONFIRM_MS); wait.unref(); }),
-            ]);
+            let timer;
+            let settled;
+            try {
+                settled = await Promise.race([
+                    confirmation.then(() => true),
+                    // This bounded wait is part of verify()/settle(), so it must keep the process alive.
+                    new Promise(resolve => { timer = setTimeout(() => resolve(false), CANCEL_CONFIRM_MS); }),
+                ]);
+            }
+            finally {
+                clearTimeout(timer);
+            }
             if (!settled)
                 return { note: `remote cancel unconfirmed after ${CANCEL_CONFIRM_MS} ms`, stopped: false };
             return confirmed === true
@@ -197,8 +218,10 @@ export class ProcessVerifier {
                 cwd: this.options.cwd, env: this.options.env, signal: controller.signal, onLine,
             });
             // A cancelled review decides nothing, and is not a verifier outage either.
-            if (cancelled)
+            if (cancelled) {
+                await cancelNote();
                 return { type: 'cancelled' };
+            }
             // The child stopped because the host wants a human: cancel the turn it left waiting (bounded,
             // reported), and hand the request to the caller instead of retrying into the same block.
             if (human !== undefined) {

package/dist/contracts.d.ts

@@ -12,11 +12,26 @@ export type { LivePhase, Message } from './session/transcript.ts';
 export type { FileReference } from './references.ts';
 export type { HistorySearch, RemovalTarget } from './session/types.ts';
 export type { QueuedInput } from './session/telemetry.ts';
-export type { ModelState, PanelState } from './session/info.ts';
 export type { CostTotal, Coverage } from './cost/index.ts';
 export type { ShellBlock } from './shell/index.ts';
-import type { ModelState, PanelState } from './session/info.ts';
-import type { RemovalTarget } from './session/types.ts';
+import type { HistorySearch, RemovalTarget } from './session/types.ts';
+import type { ObjectValue } from './json.ts';
+/** Data delivered to dialogs; visibility and keyboard ownership belong to the UI. */
+export interface ModelState {
+    catalog: ObjectValue;
+    provider?: string;
+    model?: ObjectValue;
+}
+export interface HistoryPanel {
+    query: string;
+    contentSearch: boolean;
+    matches?: HistorySearch;
+}
+export interface SearchPanel {
+    query: string;
+    items: ObjectValue[];
+    hasMore: boolean;
+}
 /** One user-saved shortcut prompt; the client owns the list, no session or host does. */
 export interface SavedPrompt {
     id: string;
@@ -263,10 +278,10 @@ export type ViewEffect =
 /** Payload that opens its own panel. */
  | {
     kind: 'history';
-    history: PanelState['history'];
+    history: HistoryPanel | undefined;
 } | {
     kind: 'search';
-    search: PanelState['search'];
+    search: SearchPanel | undefined;
 } | {
     kind: 'model';
     model: ModelState;

package/dist/controller/connection-streams.d.ts

@@ -0,0 +1,22 @@
+/** Event/control subscriptions and their startup deadlines belong to one connection generation. */
+import { Client } from '../transport/client.ts';
+import { type HostEvent } from '../transport/events.ts';
+export interface StreamHost {
+    identified(clientId: string): void;
+    event(event: HostEvent): boolean;
+    changed(): void;
+    degraded(message: string): void;
+    fail(error: Error): void;
+}
+export declare class ConnectionStreams {
+    private readonly client;
+    private readonly host;
+    private readonly subscriptions;
+    private readonly abort;
+    private readonly signal;
+    constructor(client: Client, host: StreamHost, signal: AbortSignal);
+    start(): Promise<void>;
+    close(): void;
+    /** Resolve the first usable frame while retaining the stream until this generation ends. */
+    private follow;
+}