@ljwei-stak/dsh-model-route-bot 0.66.3 → 0.67.0

package/packages/bot-engines/src/host-registrations.mjs

@@ -0,0 +1,105 @@
+import { isAbsolute, join } from 'node:path'
+import { mkdir, writeFile } from 'node:fs/promises'
+import { createClaudeLlmAdapter } from './claude-llm-adapter.mjs'
+
+const fail = code => { throw Object.assign(new Error(code), { code }) }
+const plain = value => value && typeof value === 'object' && !Array.isArray(value)
+const keys = (value, names) => { if (!plain(value) || Object.keys(value).some(key => !names.includes(key))) fail('CONVERSATION_ENGINE_CONFIG_INVALID') }
+const id = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,100}$/.test(value)
+const hash = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value)
+
+/** Host configuration, never a Bot binding or model/request payload. */
+export function normalizeConversationEngines(value = []) {
+  if (!Array.isArray(value) || value.length > 32) fail('CONVERSATION_ENGINE_CONFIG_INVALID')
+  const profiles = value.map(item => {
+    keys(item, ['id', 'driver', 'provider', 'model', 'name', 'entry', 'credentialRef', 'deadlineMs', 'hostTools'])
+    if (!id(item.id) || item.driver !== 'claude' || !id(item.provider)
+      || typeof item.model !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/.test(item.model)) fail('CONVERSATION_ENGINE_CONFIG_INVALID')
+    keys(item.entry, ['executable', 'sha256', 'version', 'script', 'scriptSha256'])
+    const entry = item.entry
+    if (!isAbsolute(entry.executable ?? '') || !hash(entry.sha256) || typeof entry.version !== 'string'
+      || !/^[0-9][A-Za-z0-9.+_-]{0,31}$/.test(entry.version)) fail('CONVERSATION_ENGINE_ENTRY_INVALID')
+    if (entry.script !== undefined && (!isAbsolute(entry.script) || !hash(entry.scriptSha256))
+      || entry.script === undefined && entry.scriptSha256 !== undefined) fail('CONVERSATION_ENGINE_ENTRY_INVALID')
+    if (typeof item.credentialRef !== 'string' || !/^ds-secret\/[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(item.credentialRef)) fail('CONVERSATION_ENGINE_CREDENTIAL_REF_INVALID')
+    const deadlineMs = item.deadlineMs ?? 1_800_000
+    if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1000 || deadlineMs > 7_200_000) fail('CONVERSATION_ENGINE_DEADLINE_INVALID')
+    if (item.name !== undefined && (typeof item.name !== 'string' || !item.name.trim() || item.name.length > 128)) fail('CONVERSATION_ENGINE_CONFIG_INVALID')
+    if (item.hostTools !== undefined && typeof item.hostTools !== 'boolean') fail('CONVERSATION_ENGINE_CONFIG_INVALID')
+    return Object.freeze({ id: item.id, driver: item.driver, provider: item.provider, model: item.model,
+      name: item.name ?? 'Claude（订阅会话）', entry: Object.freeze({ ...entry }), credentialRef: item.credentialRef, deadlineMs,
+      hostTools: item.hostTools === true })
+  })
+  for (const field of ['id', 'provider']) if (new Set(profiles.map(profile => profile[field])).size !== profiles.length) fail('CONVERSATION_ENGINE_DUPLICATE')
+  return Object.freeze(profiles)
+}
+
+/** Copy an explicitly selected Host-only opaque CLI credential into a private home.
+ * No ambient account discovery, model arguments or credentials enter argv/catalogs.
+ */
+export function validateClaudeProfileCredential(value) {
+  if (typeof value !== 'string' || Buffer.byteLength(value) > 128_000) fail('CONVERSATION_ENGINE_CREDENTIAL_INVALID')
+  let parsed
+  try { parsed = JSON.parse(value) } catch { fail('CONVERSATION_ENGINE_CREDENTIAL_INVALID') }
+  if (!plain(parsed) || !Object.keys(parsed).length) fail('CONVERSATION_ENGINE_CREDENTIAL_INVALID')
+  return value
+}
+
+export async function provisionClaudeProfile(home, profile, resolveSecret) {
+  if (!isAbsolute(home ?? '') || typeof resolveSecret !== 'function') fail('CONVERSATION_ENGINE_CREDENTIAL_UNAVAILABLE')
+  const value = validateClaudeProfileCredential(await resolveSecret(profile.credentialRef, profile))
+  const dir = join(home, '.claude')
+  await mkdir(dir, { recursive: true, mode: 0o700 })
+  await writeFile(join(dir, '.credentials.json'), value, { mode: 0o600 })
+}
+
+/** Mount explicitly configured text-only routes into the Host's public model catalog.
+ * Registration starts no native process; the existing model waterfall owns all money.
+ */
+export async function mountConversationEngines({ llm, profiles = [], runtimeRoot, identityFor, fundingFor, resolveSecret, requestFor, toolsFor, onActivity } = {}) {
+  const registrations = []
+  if (profiles.length && (typeof llm?.registerAdapter !== 'function' || !isAbsolute(runtimeRoot ?? '')
+    || typeof identityFor !== 'function' || typeof fundingFor !== 'function' || typeof resolveSecret !== 'function')) fail('CONVERSATION_ENGINE_HOST_REQUIRED')
+  const close = async () => {
+    const failures = []
+    for (const item of registrations.splice(0).reverse()) {
+      try { await item.adapter.close() } catch (error) { failures.push(error) }
+      try { item.release() } catch (error) { failures.push(error) }
+    }
+    if (failures.length) throw new AggregateError(failures, 'CONVERSATION_ENGINE_CLOSE_FAILED')
+  }
+  try {
+    for (const profile of profiles) {
+      if (profile.hostTools && typeof toolsFor !== 'function') fail('CONVERSATION_ENGINE_TOOL_HOST_REQUIRED')
+      const adapter = createClaudeLlmAdapter({ provider: profile.provider, model: profile.model, name: profile.name,
+        funding: 'subscription', fundingFor: route => fundingFor(profile, route),
+        entry: profile.entry, runtimeRoot: join(runtimeRoot, profile.id), deadlineMs: profile.deadlineMs,
+        workspaceFor: async () => join(runtimeRoot, profile.id, 'workspace'),
+        identityFor: route => identityFor(profile, route),
+        ...(requestFor ? { requestFor: (request, identity) => requestFor(profile, request, identity) } : {}),
+        ...(profile.hostTools ? { toolsFor: identity => toolsFor(profile, identity) } : {}),
+        ...(onActivity ? { onActivity: event => onActivity(profile, event) } : {}),
+        provisionCredentials: (home, identity) => provisionClaudeProfile(home, profile, (ref, current) => resolveSecret(ref, current, identity)),
+        tools: [], handlers: [], permissionMode: 'default' })
+      await mkdir(join(runtimeRoot, profile.id, 'workspace'), { recursive: true, mode: 0o700 })
+      try {
+        const release = llm.registerAdapter([profile.provider], adapter)
+        registrations.push({ profileId: profile.id, adapter, release })
+      } catch (error) { await adapter.close(); throw error }
+    }
+  } catch (error) { await close(); throw error }
+  return Object.freeze({ close,
+    activityHealth: () => ({ failures: registrations.reduce((total, item) => total + (item.adapter.snapshot().activityObserverFailures ?? 0), 0) }),
+    invalidateBot: (profileId, botId, reason) => registrations.find(item => item.profileId === profileId)?.adapter.invalidateBot(botId, reason),
+    async retireBot(botId, reason = 'new-conversation') {
+      const retired = await Promise.all(registrations.map(item => item.adapter.invalidateBot(botId, reason)))
+      const count = retired.reduce((total, item) => total + item.retired, 0), evidence = retired.flatMap(item => item.evidence)
+      if (count === 0) return { notStarted: true, possiblyApplied: false }
+      if (evidence.length !== count || evidence.some(item => !item || item.possiblyApplied === true || item.status === 'unknown'
+        || !(item.treeStopped === true || item.notStarted === true && item.possiblyApplied === false))) return { status: 'unknown', treeStopped: false }
+      return evidence.every(item => item.notStarted === true) ? { notStarted: true, possiblyApplied: false } : { treeStopped: true }
+    },
+    catalog: () => profiles.map(profile => ({ id: profile.id, driver: profile.driver, provider: profile.provider,
+      model: profile.model, name: profile.name, funding: 'subscription', input: 'text', hostTools: profile.hostTools, status: 'configured' })) })
+}
+

package/packages/capability-broker/src/cli-bootstrap.mjs

@@ -5,17 +5,43 @@ import { isAbsolute, join } from 'node:path'
 import { performance } from 'node:perf_hooks'
 import { fileURLToPath } from 'node:url'
 import { PolicyError } from './authority.mjs'
+import { bridgeResponseFrames, normalizeBridgeMcpResult } from './cli-bridge-response.mjs'
 import { nativeProcess, resolveNativeHelper } from '../../cli-runtime/src/native-process.mjs'
 
 const BRIDGE = fileURLToPath(new URL('./cli-stdio-bridge.mjs', import.meta.url))
 const MAX_BYTES = 262_144
+const REQUEST_KEYS = ['type', 'id', 'op', 'name', 'args']
+
+/**
+ * A trusted handler may run under an authority name that differs from the MCP
+ * tool name the native client sees. The wire name never reaches the lease, and
+ * a handler without one is exactly its definition name.
+ */
+const capabilityOf = handler => {
+  const value = handler.capability ?? handler.definition.name
+  if (typeof value !== 'string' || !value || Buffer.byteLength(value) > 256) throw new TypeError('INVALID_HANDLER_CAPABILITY')
+  return value
+}
 
 /** CLI-grandchild handoff: public signed locator, OS peer identity, host-only capability lease. */
-export async function createCliBootstrap({ authority, subject, binding, tools, handlers, home, ttlMs = 30_000, helper }) {
+export async function createCliBootstrap({ authority, subject, binding, tools, handlers, home, ttlMs = 30_000, helper, contextFor = null }) {
   if (!isAbsolute(home)) throw new TypeError('An isolated absolute home is required')
+  // Host-owned per-turn context. The Host, never the native client, decides
+  // whether this receiver is inside a live turn.
+  if (contextFor !== null && typeof contextFor !== 'function') throw new TypeError('INVALID_HOST_CONTEXT_CALLBACK')
   const ownedBinding = Object.freeze({ ...binding })
   const registry = new Map(handlers.map(handler => [handler.definition.name, handler]))
   if (registry.size !== handlers.length || tools.some(name => !registry.has(name))) throw new TypeError('Unknown or duplicate bridge handler')
+  // Selected wire names, each paired with the authority name it runs under.
+  // Unselected handlers stay inert: no capability, no definition, no execution.
+  const selected = new Map(tools.map(name => [name, { handler: registry.get(name), capability: capabilityOf(registry.get(name)) }]))
+  const leaseTools = [...new Set([...selected.values()].map(entry => entry.capability))]
+  const byCapability = new Map()
+  for (const entry of selected.values()) {
+    const sharing = byCapability.get(entry.capability)
+    if (sharing) sharing.push(entry.handler)
+    else byCapability.set(entry.capability, [entry.handler])
+  }
   if (!Number.isSafeInteger(ttlMs) || ttlMs < 1000 || ttlMs > 7_200_000 || typeof authority.renew !== 'function') throw new TypeError('BOUNDED_RENEWABLE_LEASE_REQUIRED')
   const leaseTtlMs = Math.min(30_000, ttlMs)
   const startedAt = performance.now()
@@ -42,17 +68,38 @@ export async function createCliBootstrap({ authority, subject, binding, tools, h
     if(Buffer.byteLength(endpoint)>103){await rmdir(socketDirectory);throw new Error('PRIVATE_SOCKET_PATH_TOO_LONG')}
   }
   let lease
-  try{lease=authority.issue(subject,{binding:ownedBinding,tools,ttlMs:leaseTtlMs})}
+  try{lease=authority.issue(subject,{binding:ownedBinding,tools:leaseTools,ttlMs:leaseTtlMs})}
   catch(error){if(socketDirectory)await rmdir(socketDirectory);throw error}
   let relay, closed = false, bound = false, connected = false, closing
-  let accepted, rejected = 0, requests = 0, replies = 0
+  let accepted, rejected = 0, requests = 0, replies = 0, highestRequestId = 0
   const active = new Map()
   const release = () => { authority.release(lease.token); for (const controller of active.values()) controller.abort(new Error('BRIDGE_CLOSED')) }
-  const reply = (id, value) => {
+  const reply = async (id, value, signal) => {
     if (!relay || relay.closed) return
     replies++
-    const wire = { type: 'response', id, ...value }
-    void relay.send(Buffer.byteLength(JSON.stringify(wire)) > MAX_BYTES ? { type: 'response', id, ok: false, code: 'OUTPUT_LIMIT' } : wire).catch(() => {})
+    for (const frame of bridgeResponseFrames(id, value)) {
+      signal?.throwIfAborted()
+      await relay.send(frame)
+    }
+  }
+  /**
+   * Host turn context, read synchronously after the structural and replay
+   * guards. The Host owns the returned object; nothing in it can widen the
+   * binding, the lease or the final signal the handler observes.
+   */
+  const hostContext = (op, name, id) => {
+    if (!contextFor) return null
+    let value
+    try { value = contextFor({ op, name, id }) }
+    catch (error) { throw error instanceof PolicyError ? error : new PolicyError('CONTEXT_UNAVAILABLE', { gate: 'host-context' }) }
+    if (!value || typeof value !== 'object' || typeof value.then === 'function') throw new PolicyError('CONTEXT_UNAVAILABLE', { gate: 'host-context' })
+    return value
+  }
+  /** The receiver's own cancel signal combined with the Host turn signal. */
+  const requestSignal = (controller, context) => {
+    const signal = context?.signal ?? null
+    if (signal !== null && !(signal instanceof AbortSignal)) throw new PolicyError('CONTEXT_UNAVAILABLE', { gate: 'host-signal' })
+    return signal ? AbortSignal.any([controller.signal, signal]) : controller.signal
   }
   async function request(message) {
     requests++
@@ -60,21 +107,44 @@ export async function createCliBootstrap({ authority, subject, binding, tools, h
     if (message.type === 'cancel') { active.get(message.id)?.abort(new Error('REQUEST_CANCELLED')); return }
     if (message.type !== 'request') return
     const id = message.id
+    // One bounded receiver-side counter instead of a set of seen ids: a bridge
+    // client numbers its requests strictly upward, so anything at or below the
+    // highest one already ran or is running and is never run again. The check
+    // sits before every await, so same-tick and out-of-order replays are
+    // refused before a handler starts. A cancel may still name an active id.
+    if (id <= highestRequestId) { void reply(id, { ok: false, code: 'DUPLICATE_REQUEST' }).catch(() => {}); return }
+    highestRequestId = id
     try {
       if (closed) throw new PolicyError('BRIDGE_CLOSED')
-      if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES || Object.keys(message).some(key => !['type', 'id', 'op', 'name', 'args'].includes(key))) throw new PolicyError('INVALID_REQUEST')
-      if (active.has(id) || active.size >= 16) throw new PolicyError('BUSY')
-      if (message.op === 'list') { reply(id, { ok: true, value: authority.list(lease.token, ownedBinding).map(name => registry.get(name).definition) }); return }
+      if (Buffer.byteLength(JSON.stringify(message)) > MAX_BYTES || Object.keys(message).some(key => !REQUEST_KEYS.includes(key))) throw new PolicyError('INVALID_REQUEST')
+      // The replay guard already refuses an id that is at or below the highest
+      // one, so an active id can never re-enter here.
+      if (active.size >= 16) throw new PolicyError('BUSY')
+      if (message.op === 'list') {
+        const context = hostContext('list', null, id)
+        requestSignal(new AbortController(), context).throwIfAborted()
+        await reply(id, { ok: true, value: authority.list(lease.token, ownedBinding).flatMap(capability => byCapability.get(capability) ?? []).map(handler => handler.definition) })
+        return
+      }
       if (message.op !== 'call') throw new PolicyError('INVALID_REQUEST')
-      const controller = new AbortController(); active.set(id, controller)
+      const entry = selected.get(message.name)
+      if (!entry) throw new PolicyError('TOOL_DENIED')
+      const context = hostContext('call', message.name, id)
+      const controller = new AbortController()
+      const signal = requestSignal(controller, context)
+      active.set(id, controller)
       try {
-        const value = await authority.run(lease.token, ownedBinding, message.name, ({ signal }) => {
-          const handler = registry.get(message.name)
-          return handler.execute(handler.parse(message.args), { signal, binding: ownedBinding })
-        }, { signal: controller.signal })
-        reply(id, { ok: true, value })
+        signal.throwIfAborted()
+        const value = await authority.run(lease.token, ownedBinding, entry.capability, ({ signal: authoritySignal }) => {
+          authoritySignal.throwIfAborted()
+          return entry.handler.execute(entry.handler.parse(message.args), { signal: authoritySignal, binding: ownedBinding, context })
+        }, { signal })
+        signal.throwIfAborted()
+        const mcpResult = entry.handler.render ? normalizeBridgeMcpResult(await entry.handler.render(value)) : null
+        signal.throwIfAborted()
+        await reply(id, { ok: true, ...(mcpResult ? { mcpResult } : { value }) }, signal)
       } finally { active.delete(id) }
-    } catch (error) { reply(id, { ok: false, code: error instanceof PolicyError ? error.code : 'HANDLER_REFUSED' }) }
+    } catch (error) { await reply(id, { ok: false, code: error instanceof PolicyError ? error.code : 'HANDLER_REFUSED' }).catch(() => {}) }
   }
   const close = () => {
     if (closing) return closing

package/packages/capability-broker/src/cli-bridge-response.mjs

@@ -0,0 +1,80 @@
+import { createHash } from 'node:crypto'
+
+const CHUNK_BYTES = 128 * 1024
+const MAX_RESPONSE = 9 * 1024 * 1024
+const MAX_BUFFERED = 16 * 1024 * 1024
+const fail = () => { throw new Error('INVALID_BRIDGE_RESPONSE') }
+const sha = bytes => createHash('sha256').update(bytes).digest('hex')
+
+/** Large MCP pictures cross the existing bounded native pipe in small frames. */
+export function* bridgeResponseFrames(id, value) {
+  let bytes = Buffer.from(JSON.stringify({ type: 'response', id, ...value }))
+  if (bytes.length > MAX_RESPONSE) bytes = Buffer.from(JSON.stringify({ type: 'response', id, ok: false, code: 'OUTPUT_LIMIT' }))
+  if (bytes.length <= CHUNK_BYTES) { yield JSON.parse(bytes.toString('utf8')); return }
+  yield { type: 'response-start', id, bytes: bytes.length }
+  for (let offset = 0, index = 0; offset < bytes.length; offset += CHUNK_BYTES, index++) {
+    yield { type: 'response-chunk', id, index, data: bytes.subarray(offset, offset + CHUNK_BYTES).toString('base64') }
+  }
+  yield { type: 'response-end', id, sha256: sha(bytes) }
+}
+
+/** Reassembly is bounded across all pending calls and releases on cancellation. */
+export class BridgeResponseReader {
+  #parts = new Map()
+  #buffered = 0
+
+  drop(id) {
+    const state = this.#parts.get(id)
+    if (state) this.#buffered -= state.size
+    this.#parts.delete(id)
+  }
+
+  clear() { this.#parts.clear(); this.#buffered = 0 }
+
+  accept(frame) {
+    if (!Number.isSafeInteger(frame?.id) || frame.id < 1) fail()
+    if (frame.type === 'response') { this.drop(frame.id); return frame }
+    if (frame.type === 'response-start') {
+      if (this.#parts.has(frame.id) || this.#parts.size >= 16 || !Number.isSafeInteger(frame.bytes)
+        || frame.bytes <= CHUNK_BYTES || frame.bytes > MAX_RESPONSE) fail()
+      this.#parts.set(frame.id, { expected: frame.bytes, size: 0, chunks: [] })
+      return null
+    }
+    const state = this.#parts.get(frame.id)
+    if (!state) fail()
+    if (frame.type === 'response-chunk') {
+      if (frame.index !== state.chunks.length || typeof frame.data !== 'string' || frame.data.length > Math.ceil(CHUNK_BYTES / 3) * 4) fail()
+      const bytes = Buffer.from(frame.data, 'base64')
+      if (!bytes.length || bytes.length > CHUNK_BYTES || bytes.toString('base64') !== frame.data
+        || state.size + bytes.length > state.expected || this.#buffered + bytes.length > MAX_BUFFERED) fail()
+      state.chunks.push(bytes); state.size += bytes.length; this.#buffered += bytes.length
+      return null
+    }
+    if (frame.type !== 'response-end' || state.size !== state.expected) fail()
+    const bytes = Buffer.concat(state.chunks)
+    this.drop(frame.id)
+    if (frame.sha256 !== sha(bytes)) fail()
+    const value = JSON.parse(bytes.toString('utf8'))
+    if (value.type !== 'response' || value.id !== frame.id) fail()
+    return value
+  }
+}
+
+/** Only a trusted handler can render MCP text or pictures. */
+export function normalizeBridgeMcpResult(value) {
+  if (!value || !Array.isArray(value.content) || value.content.length > 32
+    || Object.keys(value).some(key => !['content', 'isError'].includes(key))
+    || value.isError !== undefined && typeof value.isError !== 'boolean') fail()
+  for (const block of value.content) {
+    if (block?.type === 'text') {
+      if (Object.keys(block).some(key => !['type', 'text'].includes(key)) || typeof block.text !== 'string') fail()
+    } else if (block?.type === 'image') {
+      if (Object.keys(block).some(key => !['type', 'data', 'mimeType'].includes(key))
+        || !['image/png', 'image/jpeg', 'image/webp'].includes(block.mimeType) || typeof block.data !== 'string'
+        || block.data.length > 8 * 1024 * 1024) fail()
+      const bytes = Buffer.from(block.data, 'base64')
+      if (!bytes.length || bytes.toString('base64') !== block.data || bytes.length > 6 * 1024 * 1024) fail()
+    } else fail()
+  }
+  return value
+}

package/packages/capability-broker/src/cli-stdio-bridge.mjs

@@ -5,13 +5,16 @@ import { Server } from '@modelcontextprotocol/server'
 import { serveStdio, StdioServerTransport } from '@modelcontextprotocol/server/stdio'
 import { nativeProcess, privateEnvironment } from '../../cli-runtime/src/native-process.mjs'
 import { dirname, isAbsolute } from 'node:path'
+import { BridgeResponseReader } from './cli-bridge-response.mjs'
 
 let relay, handle
 const pending = new Map()
+const responses = new BridgeResponseReader()
 let sequence = 0
 const finish = () => {
   for (const value of pending.values()) value.reject(new Error('BROKER_CLOSED'))
   pending.clear()
+  responses.clear()
   relay?.end()
 }
 try {
@@ -35,27 +38,37 @@ try {
   const ask = (op, payload, signal) => new Promise((resolve, reject) => {
     if (relay.closed || pending.size >= 16) { reject(new Error('BROKER_UNAVAILABLE')); return }
     const id = ++sequence
-    const abort = () => { const value = pending.get(id); pending.delete(id); void relay.send({ type: 'cancel', id }).catch(() => {}); value?.reject(new Error('REQUEST_CANCELLED')) }
+    const abort = () => { const value = pending.get(id); pending.delete(id); responses.drop(id); void relay.send({ type: 'cancel', id }).catch(() => {}); value?.reject(new Error('REQUEST_CANCELLED')) }
     if (signal?.aborted) { reject(new Error('REQUEST_CANCELLED')); return }
     const timer = setTimeout(abort, Math.min(remaining, 30_000))
     signal?.addEventListener('abort', abort, { once: true })
     const settle = fn => value => { clearTimeout(timer); signal?.removeEventListener('abort', abort); fn(value) }
     pending.set(id, { resolve: settle(resolve), reject: settle(reject) })
-    void relay.send({ type: 'request', id, op, ...payload }).catch(() => { const value = pending.get(id); pending.delete(id); value?.reject(new Error('BROKER_CLOSED')) })
+    void relay.send({ type: 'request', id, op, ...payload }).catch(() => { const value = pending.get(id); pending.delete(id); responses.drop(id); value?.reject(new Error('BROKER_CLOSED')) })
   })
   relay.events.on('message', message => {
-    if (message?.type !== 'response' || !Number.isSafeInteger(message.id)) return
-    const value = pending.get(message.id); pending.delete(message.id)
-    if (message.ok) value?.resolve(message.value)
-    else value?.reject(new Error(message.code ?? 'BROKER_REFUSED'))
+    if (!Number.isSafeInteger(message?.id) || !pending.has(message.id)) return
+    try {
+      const response = responses.accept(message)
+      if (!response) return
+      const value = pending.get(response.id); pending.delete(response.id)
+      if (response.ok) value?.resolve(response)
+      else value?.reject(new Error(response.code ?? 'BROKER_REFUSED'))
+    } catch {
+      const value = pending.get(message.id); pending.delete(message.id); responses.drop(message.id)
+      value?.reject(new Error('INVALID_BRIDGE_RESPONSE'))
+    }
   })
   relay.events.on('failure', () => { finish(); void handle?.close() })
   relay.events.once('closed', () => { finish(); void handle?.close() })
   handle = serveStdio(() => {
     const server = new Server({ name: 'dsh-task-capability-bridge', version: '0.0.0' }, { capabilities: { tools: {} } })
-    server.setRequestHandler('tools/list', async (_request, ctx) => ({ tools: await ask('list', {}, ctx.mcpReq.signal) }))
+    server.setRequestHandler('tools/list', async (_request, ctx) => ({ tools: (await ask('list', {}, ctx.mcpReq.signal)).value }))
     server.setRequestHandler('tools/call', async (request, ctx) => {
-      try { return { content: [{ type: 'text', text: JSON.stringify(await ask('call', { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal)) }] } }
+      try {
+        const response = await ask('call', { name: request.params.name, args: request.params.arguments ?? {} }, ctx.mcpReq.signal)
+        return response.mcpResult ?? { content: [{ type: 'text', text: JSON.stringify(response.value) }] }
+      }
       catch (error) { return { isError: true, content: [{ type: 'text', text: error.message }] } }
     })
     server.onclose = finish

package/packages/cli-runtime/src/codex-session-core.mjs

@@ -54,6 +54,9 @@ export async function createCodexSessionCore({ authority, subject, binding, oper
   await protectProfile(probe.helper, home)
   const entry = await pinCodexExecutable(suppliedEntry, home)
   const bridge = await createCliBootstrap({ authority, subject, binding, tools, handlers, home: join(home, 'b'), ttlMs: deadlineMs, helper: probe.helper })
+  // Codex filters inherited MCP environment variables. Preserve the Host-owned
+  // compiler root explicitly while keeping the CLI's private HOME and TEMP.
+  const compilerRoot = privateEnvironment(home).DSH_NATIVE_COMPILER_ROOT
   const config = [
     `model = ${JSON.stringify(requestedModel)}`, 'model_provider = "openai"', 'approval_policy = "never"', 'sandbox_mode = "read-only"',
     'web_search = "disabled"', 'cli_auth_credentials_store = "file"', 'suppress_unstable_features_warning = true',
@@ -65,6 +68,7 @@ export async function createCodexSessionCore({ authority, subject, binding, oper
     `enabled_tools = ${JSON.stringify(tools)}`, 'env_vars = []', 'startup_timeout_sec = 20',
     '[mcp_servers.dsh_task.env]', `HOME = ${JSON.stringify(home)}`, `USERPROFILE = ${JSON.stringify(home)}`,
     `TEMP = ${JSON.stringify(join(home, 'tmp'))}`, `TMP = ${JSON.stringify(join(home, 'tmp'))}`,
+    ...(compilerRoot ? [`DSH_NATIVE_COMPILER_ROOT = ${JSON.stringify(compilerRoot)}`] : []),
   ].join('\n') + '\n'
   await writeFile(join(home, 'config.toml'), config, { flag: 'wx', mode: 0o600 })
   if (provisionCredentials) await provisionCredentials(home)

package/packages/cli-runtime/src/native-cli-output.mjs

@@ -0,0 +1,57 @@
+import { createHash } from 'node:crypto'
+
+const FRAME = 262_144
+const RAW_FRAME = 18 * 1024 * 1024
+const IMAGE = 6 * 1024 * 1024
+const fail = () => { throw new Error('CLI_FRAME_LIMIT') }
+
+// Claude's verbose user/tool_result events can echo the image already delivered over MCP.
+// Keep bounded receipts for those echoes; the model has received the original pixels itself.
+function receipt(frame, rawBytes) {
+  const results = frame?.type === 'user' && frame.message?.content
+  const toolResult = Array.isArray(results) && results.length > 0 && results.every(block => block?.type === 'tool_result' && typeof block.tool_use_id === 'string')
+  if (!toolResult) { if (rawBytes > FRAME) fail(); return frame }
+  let imageBytes = 0, images = 0, nodes = 0
+  const visit = (value, depth = 0) => {
+    if (++nodes > 30000 || depth > 24) fail()
+    if (!value || typeof value !== 'object') return value
+    if (value.type === 'image') {
+      const source = value.source
+      const data = source?.type === 'base64' ? source.data : value.data
+      const mediaType = source?.type === 'base64' ? source.media_type : value.mimeType
+      if (typeof data !== 'string' || data.length > IMAGE / 3 * 4 || !['image/png', 'image/jpeg', 'image/webp'].includes(mediaType)) fail()
+      const bytes = Buffer.from(data, 'base64')
+      if (!bytes.length || bytes.length > IMAGE || bytes.toString('base64') !== data || ++images > 32 || (imageBytes += bytes.length) > IMAGE * 2) fail()
+      return { type: 'image', mediaType, bytes: bytes.length, sha256: createHash('sha256').update(bytes).digest('hex') }
+    }
+    if (Array.isArray(value)) return value.map(item => visit(item, depth + 1))
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, visit(item, depth + 1)]))
+  }
+  const result = visit(frame)
+  if (rawBytes > FRAME && !images || Buffer.byteLength(JSON.stringify(result)) > FRAME) fail()
+  return result
+}
+
+/** Bound raw JSON lines separately from the non-image session output budget. */
+export class NativeCliOutput {
+  #buffer = ''
+  #bytes = 0
+  push(text) {
+    this.#buffer += text
+    const frames = []
+    let end
+    while ((end = this.#buffer.indexOf('\n')) >= 0) {
+      const line = this.#buffer.slice(0, end)
+      this.#buffer = this.#buffer.slice(end + 1)
+      const rawBytes = Buffer.byteLength(line)
+      if (rawBytes > RAW_FRAME) fail()
+      if (!line.trim()) continue
+      const frame = receipt(JSON.parse(line), rawBytes)
+      this.#bytes += Buffer.byteLength(JSON.stringify(frame))
+      if (this.#bytes > 8 * 1024 * 1024) fail()
+      frames.push(frame)
+    }
+    if (Buffer.byteLength(this.#buffer) > RAW_FRAME) fail()
+    return frames
+  }
+}

package/packages/cli-runtime/src/native-peer.ps1

@@ -2,6 +2,46 @@ param([ValidateSet('server','client','supervise','probe','protect')][string]$Mod
 $ErrorActionPreference = 'Stop'
 [Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false, $true)
 [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$compilerPhase = $true
+try {
+  # Host-allocated compilation storage is separate from the CLI's private
+  # profile/TEMP. The root hint is not a peer credential or an execution grant.
+  $compilerRoot = $env:DSH_NATIVE_COMPILER_ROOT
+  $compilerScratch = $env:DSH_NATIVE_COMPILER_SCRATCH
+  if ([string]::IsNullOrEmpty($compilerRoot) -or [string]::IsNullOrEmpty($compilerScratch) -or
+      $compilerRoot.Length -gt 140 -or $compilerScratch.Length -gt 160 -or
+      -not [System.IO.Path]::IsPathRooted($compilerRoot) -or -not [System.IO.Path]::IsPathRooted($compilerScratch) -or
+      [System.IO.Path]::GetFileName($compilerRoot) -notmatch '^dshc-[a-f0-9]{16}$' -or
+      [System.IO.Path]::GetFileName($compilerScratch) -notmatch '^c-[A-Za-z0-9]{6}$' -or
+      -not [string]::Equals([System.IO.Path]::GetDirectoryName($compilerScratch), $compilerRoot, [System.StringComparison]::OrdinalIgnoreCase)) { throw 'COMPILER_STORAGE_INVALID' }
+  $ownerSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+  foreach ($compilerPath in @($compilerRoot, $compilerScratch)) {
+    $directory = [System.IO.DirectoryInfo]::new($compilerPath)
+    if (-not $directory.Exists -or ($directory.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'COMPILER_STORAGE_INVALID' }
+    $security = [System.Security.AccessControl.DirectorySecurity]::new()
+    $security.SetAccessRuleProtection($true, $false)
+    $security.SetOwner($ownerSid)
+    $security.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new($ownerSid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+    $directory.SetAccessControl($security)
+    $actual = $directory.GetAccessControl()
+    $rules = @($actual.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+    if (-not $actual.AreAccessRulesProtected -or $rules.Count -ne 1 -or $rules[0].IdentityReference.Value -ne $ownerSid.Value -or
+        $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or
+        $rules[0].FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl) { throw 'COMPILER_ACL_UNCONFIRMED' }
+  }
+  if ([System.IO.File]::ReadAllText([System.IO.Path]::Combine($compilerRoot, '.dsh-root')) -ne ('dsh-native-compiler-v1:' + [System.IO.Path]::GetFileName($compilerRoot) + "`n") -or
+      [System.IO.File]::ReadAllText([System.IO.Path]::Combine($compilerScratch, '.dsh-owner')) -notmatch '^[a-f0-9]{32}$') { throw 'COMPILER_STORAGE_INVALID' }
+  $compilerParameters = [System.CodeDom.Compiler.CompilerParameters]::new()
+  $compilerParameters.GenerateInMemory = $true
+  $compilerParameters.GenerateExecutable = $false
+  $compilerParameters.TempFiles = [System.CodeDom.Compiler.TempFileCollection]::new($compilerScratch, $false)
+  [void]$compilerParameters.ReferencedAssemblies.Add('System.dll')
+  [void]$compilerParameters.ReferencedAssemblies.Add('System.Core.dll')
+  $privateTemps = @{ TEMP = $env:TEMP; TMP = $env:TMP; TMPDIR = $env:TMPDIR }
+  try {
+    # csc's Win32 resource generator also uses the process TEMP; change it only
+    # for compilation, then restore it before admitting any CLI process.
+    $env:TEMP = $compilerScratch; $env:TMP = $compilerScratch; $env:TMPDIR = $compilerScratch
 # Only packaged source is compiled. No supplied command or script is evaluated.
 Add-Type -TypeDefinition @'
 using System;
@@ -286,8 +326,12 @@ public static class DshNativePeer {
     return result;
   }
 }
-'@
-try {
+'@ -CompilerParameters $compilerParameters
+  } finally {
+    foreach ($key in @('TEMP','TMP','TMPDIR')) { [System.Environment]::SetEnvironmentVariable($key, $privateTemps[$key], 'Process') }
+    [System.Environment]::SetEnvironmentVariable('DSH_NATIVE_COMPILER_SCRATCH', $null, 'Process')
+  }
+  $compilerPhase = $false
   if ($Mode -eq 'probe') {
     $result = [DshNativePeer]::ProbeJob()
     $response = @{ peer = 'windows-kernel-pid'; supervisor = 'windows-job'; available = ($result -eq 'OK') }
@@ -308,4 +352,8 @@ try {
   elseif ($Mode -eq 'server') { [DshNativePeer]::Server($spec.endpoint,[int]$spec.rootPid,[string]$spec.rootStart,[int]$spec.ttlMs) }
   elseif ($Mode -eq 'client') { [DshNativePeer]::Client($spec.endpoint,[int]$spec.serverPid,[string]$spec.serverStart,[int]$spec.ttlMs) }
   else { [DshNativePeer]::Supervise($spec.executable,[string[]]$spec.args,$spec.cwd,[int]$spec.ttlMs) }
-} catch { [Console]::Error.WriteLine('NATIVE_PEER_REFUSED: ' + $_.Exception.GetBaseException().Message); exit 2 }
+} catch {
+  $code = if ($compilerPhase) { 'NATIVE_COMPILER_FAILED' } else { $_.Exception.GetBaseException().Message }
+  if ($code -notmatch '^[A-Z][A-Z0-9_]{0,79}$') { $code = 'NATIVE_PEER_FAILED' }
+  [Console]::Error.WriteLine('NATIVE_PEER_REFUSED: ' + $code); exit 2
+}