@jingyi0605/codingns4dsh 0.1.0

package/data/build/dist/host/terminal/terminal-store.js

@@ -0,0 +1,242 @@
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+const STORE_VERSION = 1;
+/** JSON 文件写入采用同目录临时文件加 rename，避免崩溃留下半截记录。 */
+export class JsonFileTerminalStorePersistence {
+    filename;
+    constructor(filename) {
+        this.filename = filename;
+    }
+    async load() {
+        try {
+            return JSON.parse(await readFile(this.filename, 'utf8'));
+        }
+        catch (error) {
+            if (isMissingFile(error))
+                return { version: STORE_VERSION, records: [] };
+            throw error;
+        }
+    }
+    async save(document) {
+        const directory = dirname(this.filename);
+        const temporary = `${this.filename}.${process.pid}.tmp`;
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, this.filename);
+    }
+}
+/**
+ * 持久终端记录表。
+ *
+ * 所有修改在一条 promise 队列中执行；调用完成代表新状态已经落盘。这样 create、
+ * recover 与 close 不会用最后写入者覆盖彼此的结果。
+ */
+export class CodingNsTerminalStore {
+    persistence;
+    records = new Map();
+    writeTail = Promise.resolve();
+    loaded = false;
+    constructor(persistence) {
+        this.persistence = persistence;
+    }
+    async load() {
+        if (this.loaded)
+            return;
+        const document = parseDocument(await this.persistence.load());
+        this.records.clear();
+        for (const record of document.records)
+            this.records.set(recordKey(record), record);
+        this.loaded = true;
+    }
+    list(scope) {
+        this.requireLoaded();
+        const records = [...this.records.values()]
+            .filter((record) => scope === undefined || sameScope(record, scope))
+            .sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+        return records.map(cloneRecord);
+    }
+    get(identity) {
+        this.requireLoaded();
+        const record = this.records.get(recordKey(identity));
+        return record === undefined ? undefined : cloneRecord(record);
+    }
+    put(record) {
+        validateRecord(record);
+        return this.enqueue(async () => {
+            this.records.set(recordKey(record), cloneRecord(record));
+            await this.persist();
+        });
+    }
+    patch(identity, patch) {
+        return this.enqueue(async () => {
+            const key = recordKey(identity);
+            const current = this.records.get(key);
+            if (current === undefined)
+                return undefined;
+            const next = {
+                ...current,
+                ...patch,
+                ...(patch.error === undefined ? { error: current.error } : {}),
+            };
+            validateRecord(next);
+            this.records.set(key, next);
+            await this.persist();
+            return cloneRecord(next);
+        });
+    }
+    remove(identity) {
+        return this.enqueue(async () => {
+            if (!this.records.delete(recordKey(identity)))
+                return false;
+            await this.persist();
+            return true;
+        });
+    }
+    enqueue(operation) {
+        this.requireLoaded();
+        const pending = this.writeTail.then(operation, operation);
+        this.writeTail = pending.then(() => undefined, () => undefined);
+        return pending;
+    }
+    async persist() {
+        await this.persistence.save({ version: STORE_VERSION, records: this.list() });
+    }
+    requireLoaded() {
+        if (!this.loaded)
+            throw new Error('终端持久存储尚未加载');
+    }
+}
+export class InMemoryTerminalStorePersistence {
+    document;
+    constructor(initial = { version: STORE_VERSION, records: [] }) {
+        this.document = structuredClone(initial);
+    }
+    async load() {
+        return structuredClone(this.document);
+    }
+    async save(document) {
+        this.document = structuredClone(document);
+    }
+    snapshot() {
+        return structuredClone(this.document);
+    }
+}
+export function terminalStorePath(settingsDocumentPath) {
+    return `${dirname(settingsDocumentPath)}/codingns4dsh/terminals.json`;
+}
+function parseDocument(value) {
+    if (!isRecord(value) || value.version !== STORE_VERSION || !Array.isArray(value.records)) {
+        throw new TypeError('终端持久存储格式无效');
+    }
+    const records = value.records.map(parseRecord);
+    // 旧版本把 sessionId 放进主键；升级到工作区主键后，重复项保留最后更新的一条。
+    const byKey = new Map();
+    for (const record of records) {
+        const key = recordKey(record);
+        const previous = byKey.get(key);
+        if (previous === undefined || previous.updatedAt <= record.updatedAt)
+            byKey.set(key, record);
+    }
+    return { version: STORE_VERSION, records: [...byKey.values()] };
+}
+function parseRecord(value) {
+    if (!isRecord(value))
+        throw new TypeError('终端记录必须是对象');
+    const record = value;
+    validateRecord(record);
+    return cloneRecord(record);
+}
+function validateRecord(record) {
+    for (const [name, value] of [
+        ['hostId', record.hostId],
+        ['workspaceId', record.workspaceId],
+        ['terminalId', record.terminalId],
+        ['runtimeSessionKey', record.runtimeSessionKey],
+        ['shellPath', record.shellPath],
+        ['cwd', record.cwd],
+        ['title', record.title],
+        ['createdAt', record.createdAt],
+        ['updatedAt', record.updatedAt],
+    ]) {
+        if (typeof value !== 'string' || value.trim() === '')
+            throw new TypeError(`终端记录字段 ${name} 无效`);
+    }
+    if (record.dshSessionId !== undefined && (typeof record.dshSessionId !== 'string' || record.dshSessionId.trim() === '')) {
+        throw new TypeError('终端记录字段 dshSessionId 无效');
+    }
+    if (!['local-pty', 'tmux', 'conpty-powershell', 'conpty-cmd', 'conpty-git-bash'].includes(record.runtimeType)) {
+        throw new TypeError('终端记录 runtimeType 无效');
+    }
+    if (!['starting', 'running', 'exited', 'closing', 'lost', 'closed', 'error'].includes(record.state)) {
+        throw new TypeError('终端记录 state 无效');
+    }
+    if (!Number.isSafeInteger(record.cols) || record.cols < 2 || !Number.isSafeInteger(record.rows) || record.rows < 1) {
+        throw new TypeError('终端记录尺寸无效');
+    }
+    if (record.exitCode !== null && !Number.isSafeInteger(record.exitCode))
+        throw new TypeError('终端记录 exitCode 无效');
+    if (record.error !== undefined && typeof record.error !== 'string')
+        throw new TypeError('终端记录 error 无效');
+    if (record.shellProfileId !== undefined && !['zsh', 'bash', 'powershell', 'cmd', 'git-bash'].includes(record.shellProfileId)) {
+        throw new TypeError('终端记录 shellProfileId 无效');
+    }
+    if (record.shellName !== undefined && (typeof record.shellName !== 'string' || record.shellName.trim() === '')) {
+        throw new TypeError('终端记录 shellName 无效');
+    }
+    if (record.shellArgs !== undefined && (!Array.isArray(record.shellArgs) || record.shellArgs.some((value) => typeof value !== 'string'))) {
+        throw new TypeError('终端记录 shellArgs 无效');
+    }
+    if (record.commandPath !== undefined && (typeof record.commandPath !== 'string' || record.commandPath.trim() === '')) {
+        throw new TypeError('终端记录 commandPath 无效');
+    }
+    if (record.commandArgs !== undefined && (!Array.isArray(record.commandArgs) || record.commandArgs.some((value) => typeof value !== 'string'))) {
+        throw new TypeError('终端记录 commandArgs 无效');
+    }
+    if (record.commandEnv !== undefined && (!isRecord(record.commandEnv) || Object.values(record.commandEnv).some((value) => typeof value !== 'string'))) {
+        throw new TypeError('终端记录 commandEnv 无效');
+    }
+    if (record.launchProfileId !== undefined && (typeof record.launchProfileId !== 'string' || record.launchProfileId.trim() === '')) {
+        throw new TypeError('终端记录 launchProfileId 无效');
+    }
+}
+function sameScope(record, scope) {
+    return record.hostId === scope.hostId
+        && record.workspaceId === scope.workspaceId;
+}
+function recordKey(identity) {
+    return JSON.stringify([identity.hostId, identity.workspaceId, identity.terminalId]);
+}
+function cloneRecord(record) {
+    return {
+        hostId: record.hostId,
+        workspaceId: record.workspaceId,
+        ...(record.dshSessionId === undefined ? {} : { dshSessionId: record.dshSessionId }),
+        terminalId: record.terminalId,
+        runtimeSessionKey: record.runtimeSessionKey,
+        runtimeType: record.runtimeType,
+        shellPath: record.shellPath,
+        ...(record.shellProfileId === undefined ? {} : { shellProfileId: record.shellProfileId }),
+        ...(record.shellName === undefined ? {} : { shellName: record.shellName }),
+        ...(record.shellArgs === undefined ? {} : { shellArgs: [...record.shellArgs] }),
+        ...(record.commandPath === undefined ? {} : { commandPath: record.commandPath }),
+        ...(record.commandArgs === undefined ? {} : { commandArgs: [...record.commandArgs] }),
+        ...(record.commandEnv === undefined ? {} : { commandEnv: { ...record.commandEnv } }),
+        ...(record.launchProfileId === undefined ? {} : { launchProfileId: record.launchProfileId }),
+        cwd: record.cwd,
+        title: record.title,
+        cols: record.cols,
+        rows: record.rows,
+        state: record.state,
+        exitCode: record.exitCode,
+        ...(record.error === undefined ? {} : { error: record.error }),
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isMissingFile(error) {
+    return isRecord(error) && error.code === 'ENOENT';
+}
+//# sourceMappingURL=terminal-store.js.map

package/data/build/dist/index.d.ts

@@ -0,0 +1,37 @@
+/** Host 入口是包根导出；共享契约通过显式子路径另行提供。 */
+import { apply as hostApply } from './host/index.js';
+/** Cordis Bundle 标准插件名称。 */
+export declare const name = "codingns4dsh";
+/** Host Cordis 入口。 */
+export declare const apply: typeof hostApply;
+export default hostApply;
+export { createCodingNsRpcHandler, createCodingNsSettingsRpcHandler, registerCodingNsRpc } from './host/rpc.js';
+export { CodingNsRpcError, CodingNsRpcTable, type CodingNsRpcHandler, type CodingNsRpcTarget, } from './host/rpc-table.js';
+export { HOST_FEATURES, createAuthFeature, createCliAdaptersFeature, createLanAccessDshFeature, } from './host/features/index.js';
+export type { CodingNsHostServices } from './host/features/index.js';
+export { CODINGNS_TUNNEL_DATA_CHANNEL_LABEL, FileHostDtlsIdentityStore, createRegisteredHostSignalingSocket, createWeriftPeerConnectionFactory, ensureHostDtlsIdentity, formatHostDtlsFingerprint, generateHostDtlsIdentity, startHostRelayRuntime, } from './host/relay-tunnel-runtime.js';
+export type { HostDtlsIdentityMaterial, HostDtlsIdentityStore, HostRelayRuntime, HostRelayRuntimeOptions, HostRelaySession, HostSignalingSocket, } from './host/relay-tunnel-runtime.js';
+export { createDshRpcGatewayFeature } from './host/dsh-gateway-feature.js';
+export { createLocalDshWebRuntimeProvider, createRemoteWebRuntimeFeature, type DshWebAsset, type DshWebBoot, type DshWebRuntimeProvider, type DshWebSession, type DshWebSocketLike, type LocalDshWebRuntimeProviderOptions, type RemoteWebRuntimeFeatureOptions, } from './host/remote-web-runtime.js';
+export { RemoteDshWebContext } from './client/remote-web-context.js';
+export type { RemoteDshWebBoot, RemoteDshWebContextOptions } from './client/remote-web-context.js';
+export { createHttpDshH5ControlApi, startDshH5BrowserBootstrap } from './client/dsh-h5-bootstrap.js';
+export type { DshH5BrowserBootstrapOptions, DshH5BrowserBootstrapResult, DshH5BrowserControlApi } from './client/dsh-h5-bootstrap.js';
+export { CODINGNS_RPC_CHANNEL } from './shared/contracts/transport.js';
+export { CODINGNS_CONTROL_BASE_URL_FIELD, CODINGNS_CONTROL_BASE_URLS_FIELD, CODINGNS_LAN_ACCESS_DSH_FIELD, CODINGNS_MODULES_FIELD, CODINGNS_SETTINGS_NAMESPACE, DEFAULT_CODINGNS_CONTROL_BASE_URL, DEFAULT_CODINGNS_CONTROL_BASE_URLS, DEFAULT_CODINGNS_SETTINGS, enabledFeatureNames, isFeatureEnabled, } from './shared/contracts/config.js';
+export type * from './shared/index.js';
+export { FeatureRegistry, FeatureRegistryError, FeatureResourceScopeImpl, } from './features/registry.js';
+export type { FeatureRegistryErrorCode, FeatureSnapshot, } from './features/registry.js';
+export { ResourceScopeManager } from './features/resource-scope/index.js';
+export { CodingNsAuthSession, } from './host/auth-session.js';
+export { CODINGNS_CONTROL_API_PATHS, CodingNsControlApiError, HttpCodingNsControlApiClient, type CodingNsControlApiClient, type CodingNsControlClient, type HttpCodingNsControlApiClientOptions, } from './host/control-api-client.js';
+export { InMemoryCodingNsCredentialStore, type CodingNsCredentialStore, } from './host/credential-store.js';
+export type { HostCredentialRecord } from './host/credential-store.js';
+export { LanAccessDshError, LanAccessDshProxy, createLanAccessDshRpcHandler, createNodeLanAccessDshRuntime, normalizeLanAccessDshConfig, } from './host/lan-access-dsh.js';
+export type { LanAccessDshRuntime, LanAccessDshStream } from './host/lan-access-dsh.js';
+export type { LoginByEmailResponse, RefreshTokenRequest, RefreshTokenResponse, } from './host/control-api-client.js';
+export { DshCodingNsTransport, DshTunnelMultiplexer, DshSession, DshGateway, DSH_GATEWAY_PATH, encodeDshEnvelope, decodeDshEnvelope, validateDshEnvelope, DSH_ENVELOPE_PROTOCOL, DSH_ENVELOPE_VERSION, DEFAULT_MAX_DSH_ENVELOPE_BYTES, DEFAULT_MAX_DSH_META_BYTES, createDataChannelCarrier, createRelayTunnelHostCarrier, TUNNEL_DATA_CHANNEL_LABEL, DATA_CHANNEL_FRAGMENT_PAYLOAD_BYTES, DATA_CHANNEL_FRAGMENT_HEADER_BYTES, DATA_CHANNEL_MAX_REASSEMBLY_BYTES, decodeTunnelFrame, encodeTunnelFrame, TUNNEL_PROTOCOL_VERSION, validateTunnelFrame, tunnelFrameByteLength, DEFAULT_MAX_TUNNEL_FRAME_BYTES, assertDtlsFingerprint, connectWebRtcClient, createSignalingUrl, extractDtlsFingerprint, waitForSignalingRegistered, waitForPeerReady, acceptWebRtcHost, createHostSignalingTicketRequest, requestHostSignalingTicket, createDshTransportDebugLogger, resolveDshTransportDebugEnabled, } from './transport/index.js';
+export { bindDshConnection, bindDshConnectionHooks, createDshClientTransportHooks, createDshGenerationSource, createDshGenerationSourceFromHooks, installDshTransport, SUPPORTED_DSH_CONNECTION_VERSION, } from './bootstrap/index.js';
+export type { DshClientTransportHooks, DshConnectionContext, DshConnectionHandle, DshConnectionRpcFailure, DshConnectionRpcResponse, DshConnectionRpcResult, DshGenerationSource, DshTransportLifecycle, } from './bootstrap/index.js';
+export type { CodingNsCarrier, DataChannelCarrierOptions, DataChannelLike, DshCodingNsTransportOptions, TunnelChannel, TunnelFrame, TunnelFrameKind, PeerConnectionLike, SignalingSocketLike, WebRtcClientConnection, WebRtcClientConnectorOptions, HostPeerConnectionLike, HostSignalingTicketRequest, WebRtcHostAcceptor, WebRtcHostAcceptorOptions, WebRtcHostSession, DshTunnelMultiplexerOptions, TunnelFlowControl, DshSessionOptions, DshSessionRole, DshSessionState, DshGatewayFeature, DshGatewayOptions, DshStreamContext, DshEnvelope, DshEnvelopeCodecOptions, DshEnvelopeFlags, DshHostScope, DshChannel, TunnelFrameCodecOptions, DshTransportDebugLogger, DshTransportDebugOptions, DshTransportDebugSide, } from './transport/index.js';
+//# sourceMappingURL=index.d.ts.map

package/data/build/dist/index.js

@@ -0,0 +1,26 @@
+/** Host 入口是包根导出；共享契约通过显式子路径另行提供。 */
+import { apply as hostApply } from './host/index.js';
+/** Cordis Bundle 标准插件名称。 */
+export const name = 'codingns4dsh';
+/** Host Cordis 入口。 */
+export const apply = hostApply;
+export default hostApply;
+export { createCodingNsRpcHandler, createCodingNsSettingsRpcHandler, registerCodingNsRpc } from './host/rpc.js';
+export { CodingNsRpcError, CodingNsRpcTable, } from './host/rpc-table.js';
+export { HOST_FEATURES, createAuthFeature, createCliAdaptersFeature, createLanAccessDshFeature, } from './host/features/index.js';
+export { CODINGNS_TUNNEL_DATA_CHANNEL_LABEL, FileHostDtlsIdentityStore, createRegisteredHostSignalingSocket, createWeriftPeerConnectionFactory, ensureHostDtlsIdentity, formatHostDtlsFingerprint, generateHostDtlsIdentity, startHostRelayRuntime, } from './host/relay-tunnel-runtime.js';
+export { createDshRpcGatewayFeature } from './host/dsh-gateway-feature.js';
+export { createLocalDshWebRuntimeProvider, createRemoteWebRuntimeFeature, } from './host/remote-web-runtime.js';
+export { RemoteDshWebContext } from './client/remote-web-context.js';
+export { createHttpDshH5ControlApi, startDshH5BrowserBootstrap } from './client/dsh-h5-bootstrap.js';
+export { CODINGNS_RPC_CHANNEL } from './shared/contracts/transport.js';
+export { CODINGNS_CONTROL_BASE_URL_FIELD, CODINGNS_CONTROL_BASE_URLS_FIELD, CODINGNS_LAN_ACCESS_DSH_FIELD, CODINGNS_MODULES_FIELD, CODINGNS_SETTINGS_NAMESPACE, DEFAULT_CODINGNS_CONTROL_BASE_URL, DEFAULT_CODINGNS_CONTROL_BASE_URLS, DEFAULT_CODINGNS_SETTINGS, enabledFeatureNames, isFeatureEnabled, } from './shared/contracts/config.js';
+export { FeatureRegistry, FeatureRegistryError, FeatureResourceScopeImpl, } from './features/registry.js';
+export { ResourceScopeManager } from './features/resource-scope/index.js';
+export { CodingNsAuthSession, } from './host/auth-session.js';
+export { CODINGNS_CONTROL_API_PATHS, CodingNsControlApiError, HttpCodingNsControlApiClient, } from './host/control-api-client.js';
+export { InMemoryCodingNsCredentialStore, } from './host/credential-store.js';
+export { LanAccessDshError, LanAccessDshProxy, createLanAccessDshRpcHandler, createNodeLanAccessDshRuntime, normalizeLanAccessDshConfig, } from './host/lan-access-dsh.js';
+export { DshCodingNsTransport, DshTunnelMultiplexer, DshSession, DshGateway, DSH_GATEWAY_PATH, encodeDshEnvelope, decodeDshEnvelope, validateDshEnvelope, DSH_ENVELOPE_PROTOCOL, DSH_ENVELOPE_VERSION, DEFAULT_MAX_DSH_ENVELOPE_BYTES, DEFAULT_MAX_DSH_META_BYTES, createDataChannelCarrier, createRelayTunnelHostCarrier, TUNNEL_DATA_CHANNEL_LABEL, DATA_CHANNEL_FRAGMENT_PAYLOAD_BYTES, DATA_CHANNEL_FRAGMENT_HEADER_BYTES, DATA_CHANNEL_MAX_REASSEMBLY_BYTES, decodeTunnelFrame, encodeTunnelFrame, TUNNEL_PROTOCOL_VERSION, validateTunnelFrame, tunnelFrameByteLength, DEFAULT_MAX_TUNNEL_FRAME_BYTES, assertDtlsFingerprint, connectWebRtcClient, createSignalingUrl, extractDtlsFingerprint, waitForSignalingRegistered, waitForPeerReady, acceptWebRtcHost, createHostSignalingTicketRequest, requestHostSignalingTicket, createDshTransportDebugLogger, resolveDshTransportDebugEnabled, } from './transport/index.js';
+export { bindDshConnection, bindDshConnectionHooks, createDshClientTransportHooks, createDshGenerationSource, createDshGenerationSourceFromHooks, installDshTransport, SUPPORTED_DSH_CONNECTION_VERSION, } from './bootstrap/index.js';
+//# sourceMappingURL=index.js.map

package/data/build/dist/shared/contracts/auth.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Codingns4DSH 控制面认证契约。
+ *
+ * 这些 DTO 与 codingns-proxy/packages/shared-contracts 保持字段兼容。
+ * 阶段 2 只定义数据边界，不在插件中发起真实网络请求。
+ */
+export type AccountRole = 'user' | 'admin';
+export type AccountStatus = 'pending_verification' | 'active' | 'disabled';
+export interface AccountProfile {
+    accountId: string;
+    email: string;
+    emailVerified: boolean;
+    role: AccountRole;
+    mustChangePassword: boolean;
+    createdAt: string;
+    status?: AccountStatus;
+    sessionVersion?: number;
+}
+export interface LoginByEmailRequest {
+    email: string;
+    password: string;
+}
+export type AuthClientType = 'desktop' | 'web' | 'ios' | 'android' | 'unknown';
+export interface AuthDeviceViewDto {
+    deviceId: string | null;
+    clientType: AuthClientType;
+    clientInstanceId: string | null;
+    displayName: string | null;
+    browserName: string | null;
+    browserVersion: string | null;
+    osName: string | null;
+    osVersion: string | null;
+    lastSourceAddress: string | null;
+    lastSeenAt: string;
+    isPrimary: boolean;
+    isCurrent: boolean;
+    isLegacy: boolean;
+}
+export interface RecentLoginRecordViewDto {
+    id: string;
+    deviceId: string | null;
+    clientType: AuthClientType;
+    displayName: string | null;
+    browserName: string | null;
+    browserVersion: string | null;
+    osName: string | null;
+    osVersion: string | null;
+    sourceAddress: string | null;
+    occurredAt: string;
+    isCurrentDevice: boolean;
+    isLegacy: boolean;
+}
+export interface AuthDeviceManagementSnapshotDto {
+    currentDevice: AuthDeviceViewDto | null;
+    otherActiveDevices: AuthDeviceViewDto[];
+    recentLoginRecords: RecentLoginRecordViewDto[];
+}
+export interface TunnelBindingSummary {
+    bindingId: string;
+    tunnelDomain: string;
+    hostPublicKey: string;
+    hostFingerprint: string;
+    relayBaseUrl: string;
+    controlBaseUrl: string;
+    sessionRateLimitBytesPerSecond: string | null;
+    effectiveSessionRateLimitBytesPerSecond: string | null;
+    status: 'active' | 'disabled';
+    credentialVersion?: number;
+    runtime?: {
+        online: boolean;
+        onlineSince: string | null;
+        lastHeartbeatAt: string | null;
+        localTargetBaseUrl: string | null;
+        candidateEndpoints: Array<{
+            endpointId: string;
+            kind: 'relay' | 'lan' | 'loopback' | 'tailscale' | 'custom';
+            url: string;
+            priority: number;
+            expiresAt: string | null;
+            source: 'host_reported' | 'desktop_scan' | 'user_saved';
+        }>;
+    } | null;
+}
+export interface HostBindRequest {
+    hostLabel: string;
+    hostPublicKey: string;
+    hostFingerprint: string;
+}
+export interface HostBindResponse {
+    binding: TunnelBindingSummary;
+    created: boolean;
+}
+export interface HostBindingsResponse {
+    bindings: TunnelBindingSummary[];
+}
+export interface HostUnbindResponse {
+    released: true;
+    binding: TunnelBindingSummary;
+}
+export interface HostLabelAvailabilityResponse {
+    hostLabel: string;
+    tunnelDomain: string | null;
+    available: boolean;
+    reason: 'available' | 'occupied' | 'reserved' | 'unavailable';
+}
+export type CodingNsAuthStatus = 'logged_out' | 'logging_in' | 'authenticated' | 'refreshing' | 'revoked' | 'failed';
+/** 不含 access/refresh token，可安全用于 Host 内部状态展示和日志摘要。 */
+export interface CodingNsAuthSessionSnapshot {
+    status: CodingNsAuthStatus;
+    account: AccountProfile | null;
+    currentDevice: AuthDeviceViewDto | null;
+    binding: TunnelBindingSummary | null;
+    expiresAt: string | null;
+    errorCode: string | null;
+}
+export interface CodingNsAuthLoginResult {
+    account: AccountProfile;
+    expiresAt: string;
+    currentDevice: AuthDeviceViewDto | null;
+    binding: TunnelBindingSummary | null;
+}
+//# sourceMappingURL=auth.d.ts.map

package/data/build/dist/shared/contracts/auth.js

@@ -0,0 +1,8 @@
+/**
+ * Codingns4DSH 控制面认证契约。
+ *
+ * 这些 DTO 与 codingns-proxy/packages/shared-contracts 保持字段兼容。
+ * 阶段 2 只定义数据边界，不在插件中发起真实网络请求。
+ */
+export {};
+//# sourceMappingURL=auth.js.map

package/data/build/dist/shared/contracts/cli-adapter.d.ts

@@ -0,0 +1,192 @@
+/** Codingns4DSH 当前可接入的外部 Agent 标识。内部字段沿用 cli 命名以保持协议兼容。 */
+export type CodingNsCliAdapterId = string;
+/** Host 侧可供 Client 展示的外部 Agent 摘要。 */
+export interface CodingNsCliAdapterDescriptor {
+    readonly id: CodingNsCliAdapterId;
+    readonly name: string;
+    /** 适配器使用的标准运行时协议，供设置页和诊断显示。 */
+    readonly protocol?: 'command' | 'stream-json' | 'json-rpc' | 'acp' | 'http-sse';
+    /** 适配器已经验证的能力；未声明的能力必须按不支持处理。 */
+    readonly capabilities?: readonly CodingNsCliCapability[];
+    readonly installed: boolean;
+    readonly enabled: boolean;
+    readonly version: string | null;
+    readonly command: string | null;
+}
+export type CodingNsCliCapability = 'models' | 'stream' | 'resume' | 'interrupt' | 'tool-events' | 'reasoning' | 'usage' | 'permission' | 'questions' | 'steer';
+/** 适配器模型及其可用思考强度。 */
+export interface CodingNsCliModel {
+    readonly id: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly efforts: readonly string[];
+}
+export interface CodingNsCliModelGroup {
+    readonly id: string;
+    readonly name: string;
+    readonly models: readonly CodingNsCliModel[];
+}
+export interface CodingNsCliModelCatalog {
+    readonly groups: readonly CodingNsCliModelGroup[];
+    readonly currentModel: string | null;
+    readonly currentEffort: string | null;
+}
+/** 每个 DSH 会话绑定的 CLI 选择；不包含凭据。 */
+export interface CodingNsCliSessionConfig {
+    readonly adapterId: CodingNsCliAdapterId;
+    readonly modelId?: string;
+    readonly effortId?: string;
+    /** 外部运行时会话标识，只保存在 Host 会话表中。 */
+    readonly providerSessionId?: string;
+    readonly rawStoreRef?: string;
+}
+/** Client 展示会话 Agent 时使用的最小脱敏绑定。 */
+export interface CodingNsSessionAdapterBinding {
+    readonly sessionId: string;
+    readonly adapterId: CodingNsCliAdapterId;
+}
+/** 外部 Agent 会话在 Host 侧的持久化索引。
+ *
+ * 这里只保存恢复会话所需的标识和摘要，不保存令牌、原始消息或进程句柄。
+ * dshSessionId 仍然是 DSH 的会话主键，providerSessionId 只由 Host 使用。
+ */
+export type CodingNsCliSessionStatus = 'active' | 'idle' | 'error' | 'archived';
+/** 外部 Provider 原始会话的可用状态；与 DSH 会话自身的运行状态相互独立。 */
+export type CodingNsCliProviderSessionState = 'unchecked' | 'available' | 'missing' | 'corrupt' | 'unreachable' | 'unknown' | 'ephemeral';
+export interface CodingNsCliSessionRecord extends CodingNsCliSessionConfig {
+    readonly dshSessionId: string;
+    readonly title?: string;
+    readonly cwd?: string;
+    readonly status: CodingNsCliSessionStatus;
+    /** 未填写表示旧记录尚未检查，语义等同于 unchecked。 */
+    readonly providerState?: CodingNsCliProviderSessionState;
+    readonly providerCheckedAt?: string;
+    readonly providerStateReason?: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly lastError?: string;
+}
+/** 传给 CLI 驱动的一轮完整上下文。 */
+export interface CodingNsCliTurnInput {
+    readonly sessionId: string;
+    readonly messages: readonly CodingNsCliMessage[];
+    readonly prompt: string;
+    readonly modelId?: string;
+    readonly effortId?: string;
+    readonly cwd?: string;
+    readonly signal?: AbortSignal;
+    readonly providerSessionId?: string;
+    readonly rawStoreRef?: string;
+}
+export interface CodingNsAgentPermissionResponse {
+    readonly requestId: string;
+    readonly approved: boolean;
+    readonly reason?: string;
+}
+/** 外部 Agent 请求用户回答的一道结构化问题。 */
+export interface CodingNsAgentQuestion {
+    readonly id: string;
+    readonly question: string;
+    readonly detail?: string;
+    readonly header?: string;
+    readonly options?: readonly {
+        readonly label: string;
+        readonly description?: string;
+    }[];
+    readonly multiSelect?: boolean;
+}
+/** 用户对一组外部 Agent 问题的结构化回答。 */
+export interface CodingNsAgentQuestionResponse {
+    readonly requestId: string;
+    readonly answers: readonly {
+        readonly id: string;
+        readonly selected: readonly string[];
+        readonly custom?: string;
+    }[];
+}
+export interface CodingNsCliMessage {
+    readonly id?: string;
+    readonly role: 'user' | 'assistant' | 'system';
+    readonly content: unknown;
+    /** DSH 原生消息来源；插件上下文不能被当成人类输入再次发送给外部 Agent。 */
+    readonly source?: {
+        readonly kind?: string;
+        readonly plugin?: string;
+        readonly form?: string;
+    };
+}
+/**
+ * 外部 CLI 已经执行过的工具观察事件。
+ *
+ * `status` 表示真实生命周期。该事件只能写入只读历史，不能转换成
+ * DSH 的待执行 `tool-call`。
+ */
+export interface CodingNsAgentToolEvent {
+    readonly type: 'tool-event';
+    readonly toolName: string;
+    readonly status?: 'started' | 'running' | 'completed' | 'failed';
+    readonly callId?: string;
+    readonly input?: string;
+    readonly output?: string;
+    /**
+     * output 的线协议语义。delta 表示追加片段，snapshot 表示截至当前的完整快照。
+     * 只要提供 output 就必须显式填写。
+     */
+    readonly outputMode?: 'delta' | 'snapshot';
+    readonly error?: string;
+    readonly agentId?: string;
+    readonly detail?: string;
+}
+/**
+ * 所有外部 Agent 必须输出的公共事件契约。
+ *
+ * Provider 驱动只能理解自己的线协议并生成这些事件；快照去重、交互请求、工具
+ * 历史和 DSH 原生消息映射全部由公共消息投影层负责。
+ */
+export type CodingNsAgentEvent = {
+    readonly type: 'reasoning-delta';
+    readonly text: string;
+} | {
+    readonly type: 'reasoning-snapshot';
+    readonly text: string;
+} | {
+    readonly type: 'text-delta';
+    readonly text: string;
+} | {
+    readonly type: 'text-snapshot';
+    readonly text: string;
+} | CodingNsAgentToolEvent | {
+    readonly type: 'usage';
+    /** Command Code 的 inputTokens 是包含缓存读写的完整输入。 */
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+    readonly uncachedInputTokens?: number;
+    readonly totalTokens?: number;
+    /** 缓存读取 / 完整输入，百分比取值 0 到 100。 */
+    readonly cacheHitRate?: number;
+    /** Provider 明确报告的上下文窗口及当前占用，用于会话上下文用量展示。 */
+    readonly contextWindow?: number;
+    readonly contextTokens?: number;
+    readonly contextUsageRatio?: number;
+} | {
+    readonly type: 'finish';
+    readonly reason: 'stop' | 'cancel' | 'error';
+} | {
+    readonly type: 'session-binding';
+    readonly providerSessionId: string;
+    readonly rawStoreRef?: string;
+} | {
+    readonly type: 'permission-request';
+    readonly requestId: string;
+    readonly kind: string;
+    readonly toolName?: string;
+    readonly callId?: string;
+    readonly detail?: string;
+} | {
+    readonly type: 'question-request';
+    readonly requestId: string;
+    readonly questions: readonly CodingNsAgentQuestion[];
+};
+//# sourceMappingURL=cli-adapter.d.ts.map

package/data/build/dist/shared/contracts/cli-adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli-adapter.js.map

package/data/build/dist/shared/contracts/command-code.d.ts

@@ -0,0 +1,5 @@
+import type { CliSubscriptionUsage, CliSubscriptionWindow } from './subscription.js';
+/** 兼容旧导出的 Command Code 专用名称，实际结构与所有 Provider 共用。 */
+export type CommandCodeSubscriptionWindow = CliSubscriptionWindow;
+export type CommandCodeSubscriptionUsage = CliSubscriptionUsage;
+//# sourceMappingURL=command-code.d.ts.map

package/data/build/dist/shared/contracts/command-code.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=command-code.js.map