@linxin666/dsh-client-ui-task-board 0.3.23 → 0.4.0

package/src/client/locales.ts

@@ -62,6 +62,7 @@ export const zh = {
   'new.prompt': '执行 Prompt',
   'new.promptPlaceholder': '发给 agent 的完整指令（留空则使用标题）',
   'new.submit': '创建',
+  'new.createAndRun': '创建并执行',
   'new.cancel': '取消',
   'new.required': '标题不能为空',
   'new.freeze': '冻结快照（可选）',
@@ -252,6 +253,7 @@ export const en: Record<keyof typeof zh, string> = {
   'new.prompt': 'Run Prompt',
   'new.promptPlaceholder': 'The full instruction sent to the agent (title is used when blank)',
   'new.submit': 'Create',
+  'new.createAndRun': 'Create and run',
   'new.cancel': 'Cancel',
   'new.required': 'Title is required',
   'new.freeze': 'Frozen snapshot (optional)',

package/src/client/main-session.ts

@@ -0,0 +1,43 @@
+// Generated by scripts/sync-shared.mjs from shared/client/main-session.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Main-view Session derivation for the multi-instance Client Session model.
+ *
+ * The Client Session Controller carries no global "current" selection: view
+ * selection belongs to the workspace UI, which owns the main-area reference and
+ * publishes it through the catalog's per-source ownership counts
+ * (`SessionSummary.retainedBy.mainView`). A plugin that needs the Session the
+ * main view shows derives it from that marker instead of the removed
+ * `SessionListState.current` field.
+ *
+ * The marker describes view ownership, not authority. It is the right input for
+ * presentation and for deciding which view a navigation targets; it is not a
+ * business fallback, because source counts never imply visibility or success.
+ * @module dsh-web/shared/main-session
+ */
+
+/** The catalog row subset this helper reads (a `SessionSummary` projection). */
+export interface MainViewOwnedRow<Id extends string = string> {
+  /** Catalog row identity. */
+  readonly id: Id
+  /** Per-source local ownership counts; absent rows are never owned. */
+  readonly retainedBy?: Readonly<Partial<Record<string, number>>> | undefined
+}
+
+/**
+ * Resolve the Session the main view currently shows.
+ *
+ * Reads the catalog's rows rather than a per-id retain-info source: ownership
+ * counts ride the list snapshot, so this neither allocates observers nor opens
+ * history, and a subscription to the list still fires when the selection moves.
+ * @param byId - the session catalog's rows (`SessionListState.byId`), when available.
+ * @returns the main-view session id, or undefined when the main view shows none.
+ */
+export function mainViewSessionId<Id extends string>(
+  byId: Readonly<Record<Id, MainViewOwnedRow<Id> | undefined>> | undefined | null,
+): Id | undefined {
+  if (byId === undefined || byId === null) return undefined
+  for (const row of Object.values<MainViewOwnedRow<Id> | undefined>(byId)) {
+    if (row !== undefined && (row.retainedBy?.mainView ?? 0) > 0) return row.id
+  }
+  return undefined
+}

package/src/client/plugin-card-seat.ts

@@ -0,0 +1,192 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/plugin-card-seat.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Family plugin-card seat.
+ *
+ * A family plugin contributes its settings card to whichever plugin-card seat
+ * the running host actually renders:
+ *
+ * - `web-ui.plugin.item` — the list seat declared by the dsh-web-settings
+ *   group section (this family's own first-level "Web UI plugins" section);
+ * - `plugins.bundle.config` — the official keyed seat of the harness's plugin
+ *   manager page, keyed by the bundle's package name and rendered on that
+ *   bundle's page. alpha.2 removed the `settings.plugin.item` keyed seat of the
+ *   `ui-settings-plugins` tab that this helper used before, so a card keyed by
+ *   its settings namespace has no seat to land in any more.
+ *
+ * SEAT SELECTION IS NOT A DECLARATION PROBE. The official plugin surface
+ * belongs to the harness bundle and declares its seats before any external
+ * plugin's `apply()` runs, so "is the official seat declared?" answers yes even
+ * in the deployment whose whole point is the family group. Choosing on that
+ * probe sends every family card to the official page and leaves the group's own
+ * section permanently empty — the family of reports where the section renders
+ * its heading and zero cards.
+ *
+ * The signal that actually distinguishes the two deployments is whether
+ * dsh-web-settings is loaded: it is the package that owns the group section and
+ * it publishes the `webUiSettings` service during `apply()`, which every
+ * family plugin already reads for its settings form. Group loaded -> the family
+ * seat; group absent -> the official seat.
+ *
+ * The decision is re-evaluated on every `slots/changed` because the group may
+ * apply after this plugin (the family aggregate orders it first, a profile that
+ * installs the group separately need not): the initial contribution goes to the
+ * official seat, then moves to the family seat the moment the group's section
+ * registers. The entry is disposed before the replacement is registered, so a
+ * card is never in two seats at once.
+ *
+ * The shared tree has no client-SDK dependency, so this module reads its
+ * context through the structural shape below; callers pass the plugin's own
+ * `ctx`.
+ */
+
+/** The family list seat key. */
+export const FAMILY_PLUGIN_CARD_SEAT = 'web-ui.plugin.item'
+
+/** The official keyed plugin-card seat key (the alpha.2 bundle-configuration seat). */
+export const OFFICIAL_PLUGIN_CARD_SEAT = 'plugins.bundle.config'
+
+/** The service dsh-web-settings publishes while it is loaded. */
+export const FAMILY_GROUP_SERVICE = 'webUiSettings'
+
+/** The slot-registry member this helper uses (structurally satisfied by ctx.slots). */
+export interface PluginCardSlots {
+  /** Contribution of one card entry. */
+  register(options: never, component: never): unknown
+}
+
+/** The slice of the client context a card contribution needs. */
+export interface PluginCardContext {
+  slots: PluginCardSlots
+  /** Service lookup; absent on a context double that only models the slots. */
+  get?(name: string): unknown
+  /** Event subscription seat; absent on an event-less test double. */
+  on?(event: string, listener: (...args: never[]) => void): unknown
+}
+
+/** Owner share of a family list-seat card (that seat supplies nothing). */
+export interface SettingsPluginItemOwnerProps {
+  /** Marker field: card owner props are intentionally empty. */
+  children?: never
+}
+
+/** One family plugin's card contribution. */
+export interface PluginCardSeat {
+  /**
+   * Npm package name of the bundle this card configures; the official keyed
+   * seat dispatches on it. Every family package ships its own bundle patch, so
+   * a standalone install lists that package as the bundle whose page renders
+   * this card.
+   */
+  bundle: string
+  /** Family list-seat entry id. */
+  id: string
+  /** Family list-seat sort order. */
+  order?: number
+  /** Family list-seat display label; the official keyed seat carries none. */
+  label?: () => string
+  /** Locale namespace the card renders with. */
+  locale: string
+  /** Business-face factory of the registration. */
+  inject?: () => object
+  /**
+   * The card component. Its props type is the seat's composed shape, which is
+   * chosen at runtime, so the helper takes it erased; the registrant keeps its
+   * own precise typing at the call site.
+   */
+  component: unknown
+}
+
+/**
+ * Whether the family group (dsh-web-settings) is loaded in this page. The
+ * service is the group package's own contract, so the probe cannot be fooled
+ * by a harness release that starts declaring the official seat differently.
+ */
+export function familyGroupLoaded(ctx: PluginCardContext): boolean {
+  const get = ctx.get
+  if (typeof get !== 'function') return false
+  try {
+    return get.call(ctx, FAMILY_GROUP_SERVICE) !== undefined
+  } catch {
+    // A context that refuses the lookup: treat the group as absent, which
+    // falls back to the official seat the harness declares.
+    return false
+  }
+}
+
+/** Report a refused registration instead of leaving the user with no card. */
+function warnRefusedSeat(seat: string, error: unknown): void {
+  try {
+    console.warn(`[dsh-web] plugin card registration into "${seat}" was refused; the card will not render`, error)
+  } catch {
+    // Best-effort console write; a failed warning must not break the plugin.
+  }
+}
+
+/**
+ * Contribute one family plugin card to the seat this host renders, following
+ * the group if it loads later. The entry is disposed and re-registered on a
+ * seat change, never duplicated.
+ * @param ctx - client context (its slot registry decides the seat).
+ * @param seat - the card contribution.
+ */
+export function installPluginCard(ctx: PluginCardContext, seat: PluginCardSeat): void {
+  const slots = ctx.slots
+  const component = seat.component as never
+  const inject = seat.inject as never
+
+  let dispose: (() => void) | undefined
+  let current: string | undefined
+  /**
+   * Re-entrancy latch. The registry emits a change event synchronously from
+   * inside both `register` and the previous entry's disposer, so an unguarded
+   * reconcile would re-enter itself mid-move and register the card twice into
+   * the seat it is leaving ("already has an entry for key ...").
+   */
+  let reconciling = false
+
+  /** Reconcile the contribution with the currently live seat (no-op when unchanged). */
+  const reconcile = (): void => {
+    if (reconciling) return
+    const target = familyGroupLoaded(ctx) ? FAMILY_PLUGIN_CARD_SEAT : OFFICIAL_PLUGIN_CARD_SEAT
+    if (current === target) return
+    reconciling = true
+    const previous = dispose
+    dispose = undefined
+    current = undefined
+    previous?.()
+    try {
+      dispose = slots.register((target === FAMILY_PLUGIN_CARD_SEAT
+        ? {
+          name: FAMILY_PLUGIN_CARD_SEAT,
+          id: seat.id,
+          ...(seat.order === undefined ? {} : { order: seat.order }),
+          ...(seat.label === undefined ? {} : { label: seat.label }),
+          locale: seat.locale,
+          ...(seat.inject === undefined ? {} : { inject }),
+        }
+        : {
+          name: OFFICIAL_PLUGIN_CARD_SEAT,
+          key: seat.bundle,
+          locale: seat.locale,
+          ...(seat.inject === undefined ? {} : { inject }),
+        }) as never, component) as () => void
+      current = target
+    } catch (error) {
+      warnRefusedSeat(target, error)
+    } finally {
+      reconciling = false
+    }
+  }
+
+  if (typeof ctx.on === 'function') {
+    try {
+      ctx.on('slots/changed', () => { reconcile() })
+    } catch {
+      // An event seat that refuses the subscription leaves the initial
+      // decision in place; the card still renders in the seat chosen below.
+    }
+  }
+  // The initial decision: the group, when it is already loaded (the aggregate
+  // order), otherwise the official seat the harness declares.
+  reconcile()
+}

package/src/client/settings-form.ts

@@ -8,7 +8,7 @@
  * card-store pattern.
  */
 
-import type { SettingsScope, SettingsScopeSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 
@@ -114,7 +114,7 @@ interface PlannedWrite {
   judge: (() => boolean) | undefined
 }
 
-/** One durable write inside the save's atomic scope mutation. */
+/** One durable write inside the save's atomic form mutation. */
 export interface BatchedWrite {
   /** Field this entry writes. */
   field: string
@@ -211,34 +211,34 @@ export class CardForm<T> {
   private readonly specs: Map<string, FieldSpec>
   private readonly staged = new Map<string, StagedEdit>()
   private readonly listeners = new Set<() => void>()
-  /** The scope subscription installed in the constructor; released by dispose(). */
-  private readonly disposeScope: () => void
+  /** The form subscription installed in the constructor; released by dispose(). */
+  private readonly disposeForm: () => void
   private disposed = false
   private saving = false
   private failed = false
   private failedReason: string | undefined
 
-  /** @param scope - the bound settings scope for this card's namespace. */
+  /** @param scope - the bound configuration form for this card's namespace. */
   constructor(
-    private readonly scope: SettingsScope<T>,
+    private readonly scope: ConfigForm<T>,
     specs: FieldSpec[],
   ) {
     this.specs = new Map(specs.map(spec => [spec.field, spec]))
-    this.disposeScope = scope.subscribe(() => { this.publish() })
+    this.disposeForm = scope.subscribe(() => { this.publish() })
   }
 
   /**
-   * Release the scope subscription and every bound store listener. The card
+   * Release the form subscription and every bound store listener. The card
    * must call this on teardown; later calls are no-ops.
    */
   dispose(): void {
     if (this.disposed) return
     this.disposed = true
-    this.disposeScope()
+    this.disposeForm()
     this.listeners.clear()
   }
 
-  /** Publish a projection of this form, rebuilt whenever the scope or a draft changes. */
+  /** Publish a projection of this form, rebuilt whenever the form or a draft changes. */
   bind<S>(project: () => S): SnapshotStore<S> {
     const store = createSnapshotStore(project())
     this.listeners.add(() => { store.set(project()) })
@@ -295,19 +295,19 @@ export class CardForm<T> {
   }
 
   /**
-   * Write every staged edit in one atomic scope mutation, then re-seed from
+   * Write every staged edit in one atomic form mutation, then re-seed from
    * what the Host accepted.
    *
    * The whole batch rides one mutate, so cross-field validate hooks
    * (baseURL+model) judge it as a unit: the Host either applies every write
-   * or refuses the batch. The 0.1.2 scope contract never rejects a refused
-   * mutation — the scope recovers with a fresh Host view and resolves — so
-   * resolution alone proves nothing: the outcome is judged by reading the
-   * settled snapshot back, one planned write at a time, and one missed write
-   * fails the whole save. A scope that still rejects on refusal (the dsh-web
-   * bridge scope) reports through the same failure path with its rejection
-   * message. A save that did not land keeps its drafts, so the user can
-   * correct them instead of retyping.
+   * or refuses the batch. The form contract answers a refusal or a skipped
+   * write with `false` (it recovers with a fresh Host view instead of
+   * throwing), so the outcome is judged twice: the answer itself, and then the
+   * settled snapshot read back one planned write at a time. One missed write
+   * fails the whole save. A transport that rejects instead (the dsh-web bridge
+   * controller on a dead connection) reports through the same failure path
+   * with its rejection message. A save that did not land keeps its drafts, so
+   * the user can correct them instead of retyping.
    * @returns settlement after the mutation and the read-back.
    */
   async save(): Promise<void> {
@@ -323,30 +323,33 @@ export class CardForm<T> {
     this.failed = false
     this.failedReason = undefined
     this.publish()
-    // One atomic namespace mutation: the 0.1.2 scope contract takes ordered
-    // path operations, so the whole staged batch is validated, persisted, and
+    // One atomic namespace mutation: the form contract takes ordered path
+    // operations, so the whole staged batch is validated, persisted, and
     // recovered together — either every write lands or none does.
     const ops: Array<{ op: 'set'; path: string[]; value: string | number | boolean } | { op: 'unset'; path: string[] }> = valid.map(item => item.op.op === 'set'
       ? { op: 'set', path: [item.field], value: (item.op as { value: string | number | boolean }).value }
       : { op: 'unset', path: [item.field] })
     let failedReason: string | undefined
+    let accepted = false
     try {
-      await this.scope.mutate(ops)
+      accepted = await this.scope.mutate(ops)
     } catch (error) {
       failedReason = error instanceof Error ? error.message : String(error)
     }
-    // The 0.1.2 scope resolves even a refused mutation (it recovers with a
-    // fresh view instead of throwing), so resolution alone proves nothing:
-    // judge every planned write against the settled snapshot. The mutation is
-    // atomic, so one missed write fails the whole save and keeps the drafts.
-    const landed = failedReason === undefined && valid.every(item => item.judge())
+    // `false` is the contract's refusal/skip answer, and the form still
+    // resolves after a refusal (it recovers with a fresh view), so the answer
+    // alone is not enough: judge every planned write against the settled
+    // snapshot as well. The mutation is atomic, so one missed write fails the
+    // whole save and keeps the drafts.
+    const landed = accepted && failedReason === undefined && valid.every(item => item.judge())
     for (const [field, before] of pending) {
       if (landed && this.staged.get(field) === before) this.staged.delete(field)
     }
     this.saving = false
     this.failed = !landed
-    // A read-back failure carries no server reason: the card surfaces its
-    // generic failure copy; a rejecting scope (the bridge) adds its message.
+    // A refused or unlanded batch carries no server reason: the card surfaces
+    // its generic failure copy; a rejecting transport (the bridge) adds its
+    // message.
     this.failedReason = failedReason
     this.publish()
   }
@@ -381,7 +384,7 @@ export class CardForm<T> {
    */
   private landedSet(field: string, value: unknown): boolean {
     // A redacted secret never appears in any wire view layer: the Host strips
-    // role('secret') fields and reports them through a sidecar the scope
+    // role('secret') fields and reports them through a sidecar the form
     // snapshot does not expose, so there is nothing to compare the draft
     // against. Settling is the only signal the form has; the rest of the
     // batch, when one exists, still carries the atomic verdict by read-back.
@@ -412,7 +415,7 @@ export class CardForm<T> {
     return spec
   }
 
-  private snapshotOf(): SettingsScopeSnapshot<T> {
+  private snapshotOf(): ConfigFormSnapshot<T> {
     return this.scope.getSnapshot()
   }
 

package/src/client/sidebar-entry-core.ts

@@ -84,8 +84,8 @@ function newSessionButton(root: HTMLElement): HTMLButtonElement | undefined {
   return undefined
 }
 
-/** Build the entry row (a detached button; insert once the shell is up). */
-function createEntry(options: SidebarEntryOptions): { entry: HTMLButtonElement; applyLabel: () => void } {
+/** Build the entry row (detached; inserted once the shell is up). */
+function createEntry(options: SidebarEntryOptions): { entry: HTMLElement; applyLabel: () => void } {
   const entry = document.createElement('button')
   entry.type = 'button'
   entry.setAttribute(options.rowAttribute, '')
@@ -111,7 +111,7 @@ function createEntry(options: SidebarEntryOptions): { entry: HTMLButtonElement;
 }
 
 /** Re-insert the entry after the New Session row (before the browser region). */
-function placeEntry(root: HTMLElement, entry: HTMLButtonElement, options: SidebarEntryOptions): boolean {
+function placeEntry(root: HTMLElement, entry: HTMLElement, options: SidebarEntryOptions): boolean {
   const button = newSessionButton(root)
   if (button === undefined) return false
   if (entry.parentElement !== root) {

package/src/client/sidebar-entry.ts

@@ -19,8 +19,8 @@ import { mountSidebarEntry as mountSharedSidebarEntry } from './sidebar-entry-co
 /** Stable data attribute identifying the injected entry row. */
 export const ENTRY_SELECTOR = '[data-dsh-taskboard-entry]'
 
-/** Inline icon normalized to the shell's 18px navigation glyph size. */
-const ICON = '<svg viewBox="0 0 16 16" width="18" height="18" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2" y="2.5" width="12" height="11" rx="1.5"/><path d="M2 6.5h12M6.5 6.5v7"/></svg>'
+/** Inline icon normalized to the shell's 16px navigation glyph size. */
+const ICON = '<svg viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.3" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2" y="2.5" width="12" height="11" rx="1.5"/><path d="M2 6.5h12M6.5 6.5v7"/></svg>'
 
 /** Locale-change subscription the shared core asks for (ctx.locale.subscribe shape). */
 export interface LocaleRefreshSource { subscribe(listener: () => void): () => void }

package/src/core/controller.ts

@@ -42,18 +42,22 @@ export interface TaskBoardTransport {
   parseDraft?(request: TaskBoardParseRequest, signal?: AbortSignal): Promise<TaskBoardParseDraft>
 }
 
-/** The sessions face the controller needs for navigation awareness. */
+/**
+ * The sessions face the controller needs for navigation awareness. The Client
+ * Session Controller carries no global selection since 0.1.6-alpha.2, so the
+ * wiring resolves the main-view Session once and exposes it as current().
+ */
 export interface SessionsControllerFace {
-  list: {
-    getSnapshot(): { current: string | undefined }
-    subscribe(fn: () => void): () => void
-  }
-  /** Select a session as current (navigates the conversation view). */
+  /** The Session the main view currently shows, when any. */
+  current(): string | undefined
+  /** Navigate the main view to a Session. */
   open(id: string): void
+  /** Subscribe to catalog changes; selection ownership rides the same snapshot. */
+  subscribe(fn: () => void): () => void
 }
 
 function currentOf(sessions: SessionsControllerFace | undefined): string | undefined {
-  return sessions?.list.getSnapshot().current
+  return sessions?.current()
 }
 
 /** Controller dependencies (all swappable in tests). */
@@ -194,7 +198,7 @@ export class BoardController {
       this.notify()
     }) : undefined
     if (unsubscribeExternal !== undefined) this.disposers.push(unsubscribeExternal)
-    this.disposers.push(this.deps.sessions.list.subscribe(() => {
+    this.disposers.push(this.deps.sessions.subscribe(() => {
       this.onSessionsChanged()
     }))
     this.notify()

package/src/core/session-reuse.ts

@@ -3,14 +3,16 @@
  * previous execution's conversation. Pure, so the fail-closed conditions stay
  * unit-testable without a gateway.
  */
-import type { TaskRecord } from './tasks.ts'
+import type { ExecutionRecord, TaskRecord } from './tasks.ts'
 
 /**
  * Pick the session a new execution of this task may continue in, or undefined
  * to mint a fresh conversation. Reuse requires ALL of:
  * - the task opted in (`reuseSession === true`);
- * - the task's newest execution carries a session id and has settled (an open
- *   execution would have made the ledger refuse the run in the first place);
+ * - the task's newest SETTLED execution carries a session id (issue #1587: the
+ *   launch path calls this after `startExecution` appended this run's own open
+ *   record, so reading the array tail always found an unsettled row and reuse
+ *   never happened);
  * - the roster is known and that session is present and idle.
  *
  * An unknown roster (session/list unavailable) never reuses: minting a fresh
@@ -25,7 +27,14 @@ export function reusableSessionId(
   idleSessionIds: ReadonlySet<string> | undefined,
 ): string | undefined {
   if (task.reuseSession !== true || idleSessionIds === undefined) return undefined
-  const last = task.executions[task.executions.length - 1]
-  if (last === undefined || last.sessionId === undefined || last.endedAt === undefined) return undefined
+  let last: ExecutionRecord | undefined
+  for (let index = task.executions.length - 1; index >= 0; index -= 1) {
+    const candidate = task.executions[index]
+    if (candidate.sessionId !== undefined && candidate.endedAt !== undefined) {
+      last = candidate
+      break
+    }
+  }
+  if (last === undefined || last.sessionId === undefined) return undefined
   return idleSessionIds.has(last.sessionId) ? last.sessionId : undefined
 }

package/src/host-ledger.ts

@@ -134,6 +134,11 @@ export function processIsAlive(pid: number): boolean {
 }
 
 const PROCESS_PROBE_TIMEOUT_MS = 3000
+/**
+ * The CIM fallback pays a WMI cold start, so it gets a wider budget than the
+ * direct `Get-Process` read it backs up.
+ */
+const CIM_PROBE_TIMEOUT_MS = 8000
 
 let ownStartTime: number | undefined
 let ownStartTimeResolved = false
@@ -161,6 +166,59 @@ function linuxStartTimeMs(pid: number): number | undefined {
   }
 }
 
+/** Runs one PowerShell script and returns its trimmed stdout. */
+export type PowerShellProbe = (script: string, timeoutMs: number) => string | undefined
+
+/** Default probe: one hidden, profile-free PowerShell process per script. */
+const runPowerShellProbe: PowerShellProbe = (script, timeoutMs) => {
+  const probe = spawnSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], {
+    timeout: timeoutMs,
+    windowsHide: true,
+  })
+  if (probe.status !== 0 || probe.stdout.length === 0) return undefined
+  return probe.stdout.toString('utf8').trim()
+}
+
+/** The epoch-millisecond reading a probe printed, or undefined when unusable. */
+function parseProbeEpochMs(raw: string | undefined): number | undefined {
+  if (raw === undefined || raw.trim() === '') return undefined
+  const started = Number(raw.trim())
+  return Number.isFinite(started) ? started : undefined
+}
+
+/** Start time through Get-Process: precise, but empty for protected processes. */
+function getProcessStartScript(pid: number): string {
+  return '[DateTimeOffset]::FromFileTime((Get-Process -Id ' + String(pid)
+    + ' -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()'
+}
+
+/** Start time through Win32_Process: readable for System/svchost too. */
+function cimStartScript(pid: number): string {
+  return '$p=Get-CimInstance Win32_Process -Filter "ProcessId=' + String(pid)
+    + '" -ErrorAction SilentlyContinue;if($p -ne $null){[DateTimeOffset]::FromFileTime($p.CreationDate.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()}'
+}
+
+/**
+ * Windows start time (Unix epoch ms) of a live process.
+ *
+ * `Get-Process` is the precise first choice, but an unprivileged caller cannot
+ * read `.StartTime` for a protected process (System, svchost): the property is
+ * empty, so the probe returns nothing. Without a fallback, a crash leftover
+ * lock whose PID was reused by such a process could never be proven stale and
+ * blocked every startup until the lock was deleted by hand (issue #1629).
+ * Win32_Process through CIM reports the same CreationDate for those processes
+ * at the same millisecond precision, so it is the second identity source. The
+ * probe is injectable so the fallback chain is testable off Windows.
+ */
+export function win32StartTimeMs(pid: number, probe: PowerShellProbe = runPowerShellProbe): number | undefined {
+  // The pid is interpolated into a PowerShell script, so it must be a plain
+  // positive integer before any probe runs.
+  if (!Number.isSafeInteger(pid) || pid <= 0) return undefined
+  const direct = parseProbeEpochMs(probe(getProcessStartScript(pid), PROCESS_PROBE_TIMEOUT_MS))
+  if (direct !== undefined) return direct
+  return parseProbeEpochMs(probe(cimStartScript(pid), CIM_PROBE_TIMEOUT_MS))
+}
+
 /**
  * Best-effort start time (Unix epoch ms) of a live process. Used to prove
  * whether the ledger lock really belongs to the PID recorded in it, so a
@@ -170,17 +228,7 @@ function linuxStartTimeMs(pid: number): number | undefined {
  */
 function processStartTimeMs(pid: number): number | undefined {
   if (process.platform === 'linux') return linuxStartTimeMs(pid)
-  if (process.platform === 'win32') {
-    const probe = spawnSync(
-      'powershell',
-      ['-NoProfile', '-NonInteractive', '-Command',
-        '[DateTimeOffset]::FromFileTime((Get-Process -Id ' + String(pid) + ' -ErrorAction SilentlyContinue).StartTime.ToUniversalTime().ToFileTime()).ToUnixTimeMilliseconds()'],
-      { timeout: PROCESS_PROBE_TIMEOUT_MS, windowsHide: true },
-    )
-    if (probe.status !== 0 || probe.stdout.length === 0) return undefined
-    const started = Number(probe.stdout.toString('utf8').trim())
-    return Number.isFinite(started) ? started : undefined
-  }
+  if (process.platform === 'win32') return win32StartTimeMs(pid)
   // Other POSIX (macOS...): ps lstart with a forced English locale, falling
   // back to the elapsed-seconds column when lstart cannot be parsed.
   const env = { ...process.env, LC_ALL: 'C' }

package/src/http.ts

@@ -2,7 +2,9 @@
 /**
  * Shared JSON body/response helpers for the host route families: one strict
  * bounded body reader, one lenient bounded body reader, one JSON object
- * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * narrow, one JSON writer, and the outbound request-init helper that keeps a
+ * host fetch body decodable (withIdentityEncoding). Previously the readers
+ * were copy-pasted across the
  * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
  * family's route module) with drifting contracts: body caps ranging 4 KiB to
  * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
@@ -88,6 +90,26 @@ export function asJsonObject(value: unknown): Record<string, unknown> | undefine
   return isJsonObject(value) ? value : undefined
 }
 
+/**
+ * Request init that asks a remote origin for an uncompressed body.
+ *
+ * The DSH host boots `@deepseek-ai/dsh-http-proxy`, whose top-level import of
+ * the npm `undici` copy replaces the legacy `undici.globalDispatcher.1` slot
+ * Node's built-in `fetch()` reads. That cross-major wrapper drops the
+ * `content-encoding` header and automatic decompression, so a plain fetch
+ * resolves to raw gzip/brotli/zstd bytes — compressed noise no JSON or text
+ * consumer can read. Every host fetch that parses a remote body must request
+ * identity encoding. Caller headers survive; `accept-encoding` is forced to
+ * `identity` because a caller value has no decoder behind it in this host.
+ * @param init - the caller's request init (signal, headers, method, ...).
+ * @returns a copy with `accept-encoding: identity` merged in.
+ */
+export function withIdentityEncoding(init: RequestInit = {}): RequestInit {
+  const headers = new Headers(init.headers)
+  headers.set('accept-encoding', 'identity')
+  return { ...init, headers }
+}
+
 /**
  * Write one JSON response. Default headers are the family defaults
  * (content-type and referrer-policy); caller headers are appended or