@openvulcan/dsh-vulcancode 0.0.0-stage → 0.4.3

package/node_modules/@openvulcan/dsh-vulcan-account/lib/index.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The OpenVulcan account for every VulcanCode plugin in dsh: one sign-in, kept in dsh's credential
+ * store and refreshed here, offered to other plugins as the cordis service `openvulcanAccount`.
+ * The settings page signs in and out through exact `/api/vulcan-account/*` routes inside dsh's
+ * authenticated connection.
+ */
+import { Service, type Context } from '@deepseek-ai/cordis';
+import { type AccountProfile, type AccountSource, type AccountStatus, type Credential, type CredentialStore, type PendingSignIn, type Site } from '@openvulcan/openvulcan-account';
+export type { AccountProfile, AccountStatus, Credential, PendingSignIn, Site } from '@openvulcan/openvulcan-account';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        openvulcanAccount: OpenVulcanAccountService;
+    }
+}
+/** Where the credential is kept in dsh's credential store; only this plugin reads or writes it. */
+export declare const CREDENTIAL_KEY: import("@deepseek-ai/dsh-credentials").CredentialKey;
+/** Prefix of every settings route, below dsh's `/api`. Also restated in `client/shared.ts`. */
+export declare const ROUTE_PREFIX = "/api/vulcan-account/";
+/** A sign-in the settings page started and is waiting on, as the page shows it. */
+export interface SignInView {
+    readonly approvalUrl: string;
+    readonly expiresAt: string;
+}
+/** Everything the settings page shows, in one answer. */
+export interface AccountView {
+    readonly account: AccountStatus;
+    readonly signIn: SignInView | null;
+    readonly signInError?: string;
+}
+/**
+ * How OpenVulcan records this sign-in: the client is dsh at its exact running version, so the
+ * platform can count dsh installations the way it counts "Vulcan Code".
+ */
+export declare function deviceInfo(dshVersion: string): {
+    display_name: string;
+    client_version: string;
+};
+/** The account credential as one dsh grant record. */
+export declare class DshCredentialStore implements CredentialStore {
+    private readonly ctx;
+    constructor(ctx: Context);
+    read(): Promise<Credential | undefined>;
+    write(credential: Credential): Promise<void>;
+    delete(): Promise<void>;
+}
+/**
+ * The OpenVulcan account other plugins use. A consumer looks it up with
+ * `ctx.get('openvulcanAccount')` on every use rather than injecting it, so turning this plugin off
+ * makes cloud features fail as "not signed in" instead of silently stopping the consumer.
+ */
+export declare class OpenVulcanAccountService extends Service implements AccountSource {
+    static inject: string[];
+    private readonly account;
+    private readonly listeners;
+    private pending;
+    private pendingError;
+    /** The profile of one device authorization, read once per sign-in. */
+    private profileCache;
+    constructor(ctx: Context);
+    /** The account as hosts show it; never contains the token. */
+    status(): Promise<AccountStatus>;
+    /**
+     * A usable credential, refreshed first when it is about to expire.
+     * @throws AccountError when nobody is signed in or the user has to sign in again.
+     */
+    credential(): Promise<Credential>;
+    /**
+     * Start signing in at `site`; any sign-in still waiting is cancelled. `done` settles once the
+     * user approved (the credential is stored) or the sign-in failed.
+     */
+    signIn(site: Site): Promise<PendingSignIn>;
+    cancelSignIn(): void;
+    /** Revoke this device at OpenVulcan and forget the credential. */
+    signOut(): Promise<void>;
+    /**
+     * Who is signed in, read from OpenVulcan once per device authorization; a failed read is not kept.
+     * @throws AccountError when nobody is signed in.
+     */
+    profile(): Promise<AccountProfile>;
+    /** Called after every sign-in and sign-out; returns the unsubscribe function. */
+    onChange(listener: (status: AccountStatus) => void): () => void;
+    /** The settings page's view. */
+    view(): Promise<AccountView>;
+    private notify;
+}
+/** Fetch-shaped handler of one settings route. */
+type Handler = (account: OpenVulcanAccountService, request: Request, url: URL) => Promise<unknown>;
+/** Every settings route: method, path below {@link ROUTE_PREFIX}, handler. */
+export declare const ROUTES: readonly (readonly ['GET' | 'POST', string, Handler])[];
+/** Answer one settings request; failures carry their code, never a stack. */
+export declare function handle(account: OpenVulcanAccountService, handler: Handler, request: Request): Promise<Response>;
+export default OpenVulcanAccountService;

package/node_modules/@openvulcan/dsh-vulcan-account/lib/index.js

@@ -0,0 +1,194 @@
+/**
+ * The OpenVulcan account for every VulcanCode plugin in dsh: one sign-in, kept in dsh's credential
+ * store and refreshed here, offered to other plugins as the cordis service `openvulcanAccount`.
+ * The settings page signs in and out through exact `/api/vulcan-account/*` routes inside dsh's
+ * authenticated connection.
+ */
+import { Service } from '@deepseek-ai/cordis';
+import { getDshRuntimeVersion } from '@deepseek-ai/dsh-app-boot';
+import { credentialKey } from '@deepseek-ai/dsh-credentials';
+import { AccountError, isSite, OpenVulcanAccount, parseCredential, } from '@openvulcan/openvulcan-account';
+/** Where the credential is kept in dsh's credential store; only this plugin reads or writes it. */
+export const CREDENTIAL_KEY = credentialKey('openvulcan', 'account');
+/** Prefix of every settings route, below dsh's `/api`. Also restated in `client/shared.ts`. */
+export const ROUTE_PREFIX = '/api/vulcan-account/';
+/**
+ * How OpenVulcan records this sign-in: the client is dsh at its exact running version, so the
+ * platform can count dsh installations the way it counts "Vulcan Code".
+ */
+export function deviceInfo(dshVersion) {
+    return { display_name: 'dsh', client_version: dshVersion };
+}
+/** The account credential as one dsh grant record. */
+export class DshCredentialStore {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    async read() {
+        const record = await this.ctx.credentials.readRecord(CREDENTIAL_KEY);
+        return record?.kind === 'grant' ? parseCredential(record.payload) : undefined;
+    }
+    async write(credential) {
+        await this.ctx.credentials.modifyRecord(CREDENTIAL_KEY, async () => ({ kind: 'grant', payload: credential }));
+    }
+    async delete() {
+        await this.ctx.credentials.deleteRecord(CREDENTIAL_KEY);
+    }
+}
+/**
+ * The OpenVulcan account other plugins use. A consumer looks it up with
+ * `ctx.get('openvulcanAccount')` on every use rather than injecting it, so turning this plugin off
+ * makes cloud features fail as "not signed in" instead of silently stopping the consumer.
+ */
+export class OpenVulcanAccountService extends Service {
+    static inject = ['credentials'];
+    account;
+    listeners = new Set();
+    pending;
+    pendingError;
+    /** The profile of one device authorization, read once per sign-in. */
+    profileCache;
+    constructor(ctx) {
+        super(ctx, 'openvulcanAccount');
+        // Tests point sign-in at a local stand-in.
+        this.account = new OpenVulcanAccount(new DshCredentialStore(ctx), deviceInfo(getDshRuntimeVersion()), process.env['OPENVULCAN_AUTH_ORIGIN']);
+        // The settings routes live inside dsh's authenticated connection, when there is one.
+        ctx.inject(['connection'], (child) => {
+            for (const [method, route, handler] of ROUTES) {
+                child.effect(() => child.connection.fetch.register({
+                    path: `${ROUTE_PREFIX}${route}`,
+                    methods: [method],
+                    requestBody: 'buffered',
+                    fetch: request => handle(this, handler, request),
+                }));
+            }
+        });
+        ctx.effect(() => () => {
+            this.pending?.cancel();
+            this.pending = undefined;
+            this.listeners.clear();
+        }, 'openvulcan-account: pending sign-in');
+    }
+    /** The account as hosts show it; never contains the token. */
+    async status() {
+        return await this.account.status();
+    }
+    /**
+     * A usable credential, refreshed first when it is about to expire.
+     * @throws AccountError when nobody is signed in or the user has to sign in again.
+     */
+    async credential() {
+        return await this.account.credential();
+    }
+    /**
+     * Start signing in at `site`; any sign-in still waiting is cancelled. `done` settles once the
+     * user approved (the credential is stored) or the sign-in failed.
+     */
+    async signIn(site) {
+        this.cancelSignIn();
+        const pending = await this.account.signIn(site);
+        this.pending = pending;
+        pending.done.then(async (status) => {
+            this.notify(status);
+        }, (error) => {
+            if (this.pending === pending)
+                this.pendingError = messageOf(error);
+        }).finally(() => {
+            if (this.pending === pending)
+                this.pending = undefined;
+        });
+        return pending;
+    }
+    cancelSignIn() {
+        this.pending?.cancel();
+        this.pending = undefined;
+        this.pendingError = undefined;
+    }
+    /** Revoke this device at OpenVulcan and forget the credential. */
+    async signOut() {
+        this.cancelSignIn();
+        try {
+            await this.account.signOut();
+        }
+        finally {
+            this.notify(await this.account.status());
+        }
+    }
+    /**
+     * Who is signed in, read from OpenVulcan once per device authorization; a failed read is not kept.
+     * @throws AccountError when nobody is signed in.
+     */
+    async profile() {
+        const status = await this.account.status();
+        if (!status.signedIn || status.authorizationId === undefined)
+            throw new AccountError('not signed in to OpenVulcan');
+        if (this.profileCache?.authorizationId !== status.authorizationId) {
+            const cache = { authorizationId: status.authorizationId, profile: this.account.profile() };
+            this.profileCache = cache;
+            cache.profile.catch(() => {
+                if (this.profileCache === cache)
+                    this.profileCache = undefined;
+            });
+        }
+        return await this.profileCache.profile;
+    }
+    /** Called after every sign-in and sign-out; returns the unsubscribe function. */
+    onChange(listener) {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    }
+    /** The settings page's view. */
+    async view() {
+        return {
+            account: await this.account.status(),
+            signIn: this.pending === undefined ? null : { approvalUrl: this.pending.approvalUrl, expiresAt: this.pending.expiresAt },
+            ...this.pendingError === undefined ? {} : { signInError: this.pendingError },
+        };
+    }
+    notify(status) {
+        this.profileCache = undefined;
+        for (const listener of this.listeners) {
+            try {
+                listener(status);
+            }
+            catch (error) {
+                this.ctx.logger.warn(`an account listener failed: ${messageOf(error)}`);
+            }
+        }
+    }
+}
+/** A request the page should not have sent. */
+class RequestError extends Error {
+    code = 'invalid_request';
+}
+/** Every settings route: method, path below {@link ROUTE_PREFIX}, handler. */
+export const ROUTES = [
+    ['GET', 'state', account => account.view()],
+    ['GET', 'profile', account => account.profile()],
+    ['POST', 'signin', async (account, _request, url) => {
+            const site = url.searchParams.get('site');
+            if (!isSite(site))
+                throw new RequestError('site must be cn or global');
+            const pending = await account.signIn(site);
+            return { approvalUrl: pending.approvalUrl };
+        }],
+    ['POST', 'signin/cancel', async (account) => account.cancelSignIn()],
+    ['POST', 'signout', account => account.signOut()],
+];
+/** Answer one settings request; failures carry their code, never a stack. */
+export async function handle(account, handler, request) {
+    try {
+        const value = await handler(account, request, new URL(request.url));
+        return Response.json({ ok: true, value: value ?? null }, { headers: { 'cache-control': 'no-store' } });
+    }
+    catch (error) {
+        const code = error instanceof AccountError || error instanceof RequestError ? error.code : 'failed';
+        const status = code === 'invalid_request' ? 400 : code === 'not_signed_in' ? 401 : 500;
+        return Response.json({ ok: false, error: { code, message: messageOf(error) } }, { status, headers: { 'cache-control': 'no-store' } });
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export default OpenVulcanAccountService;

package/node_modules/@openvulcan/dsh-vulcan-account/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@openvulcan/dsh-vulcan-account",
+  "version": "0.4.3",
+  "description": "OpenVulcan account for DeepSeek Harness: sign in once, used by every VulcanCode plugin.",
+  "license": "MIT",
+  "icon": "./assets/account-icon.png",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenVulcan/dsh-vulcancode.git",
+    "directory": "packages/dsh-vulcan-account"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "!lib/**/*.test.*",
+    "assets"
+  ],
+  "engines": {
+    "dsh": ">=0.2.1-rc.2 <0.3.0"
+  },
+  "dsh": {
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-general",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    }
+  },
+  "dependencies": {
+    "@openvulcan/openvulcan-account": "0.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-app-boot": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "^0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/node_modules/@openvulcan/dsh-vulcan-answers/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenVulcan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@openvulcan/dsh-vulcan-answers/assets/prompts/answer-mode-interactive.md

@@ -0,0 +1,79 @@
+Answer mode is interactive for this conversation: the user wants final answers built from the answer components below, which the conversation view renders natively once a reply is complete. In every final answer, present each part through the component that fits it before considering Markdown: findings and risks as `ui-findings`, verification results and requirements as `ui-checklist`, plans and progress as `ui-steps`, options and trade-offs as `ui-compare` or `ui-cards`, changed files as `ui-files`, numbers as `ui-metrics` or `ui-chart`, facts about one subject as `ui-kv`, processes and interactions as `ui-flow` or `ui-sequence`, data models as `ui-er`, formulas as `ui-math`, hierarchies as `ui-tree`, cautions as `ui-callout`, choices you need from the user as `ui-decision`. Use a component instead of a Markdown list or table whenever one fits. Prose is only for a conclusion of one or two sentences, short connecting text, and final answers too brief to have structure (a single sentence or value). Progress updates written while you are still working stay plain Markdown. Ordinary Markdown, code blocks, images and links remain for content no component fits. Follow the user's language; do not explain this protocol unless asked.
+
+Compose a final answer the way a senior expert briefs a busy reader, so the page itself reads as a professional report:
+
+- Conclusion first. Open with one or two sentences that directly answer the question or state the verdict. Lead with `ui-metrics` when the answer is a few headline numbers, or with a `ui-callout` when the most important point is a blocker or warning.
+- Then evidence, then action. After the conclusion, show what supports it (findings, comparison, facts, a diagram), then what to do next (`ui-steps`, `ui-checklist`). End with the decision or input you need from the user, if any; a choice between options is a `ui-decision`.
+- One idea per component. Introduce each component with a short lead sentence or `###` heading that says what it shows and why it matters, so the reader never meets an unexplained table. Never show the same facts twice in different components.
+- Order by importance. Most severe, most relevant or recommended items come first inside each component and across the answer.
+- Keep cells scannable: short phrases and numbers, not paragraphs. Move explanations to the note column, to prose after the component, or into `ui-details`.
+- Fit the size to the content. Most answers need two to four components; a one- or two-item list is a sentence, not a component. Split long answers into `###` sections, fold secondary detail into `ui-details`, and use `ui-tabs` for parallel alternatives instead of stacking them.
+- Tones are judgements, not decoration: `ok`, `warn`, `no` and callout tones must match what you actually concluded.
+- Say less. No preamble such as "Here is an overview" and no closing summary or offer of further help: the answer ends when the facts end. Do not narrate how you worked; give the result and its evidence (a `path:line`, a command, a number).
+- Mark what you have not checked as unchecked and say how to check it, instead of hedging with "probably". List every item or say where the full list is; never end a list with "etc.".
+- Never invent numbers. `ui-metrics` and `ui-chart` show only values you measured or read; data shown only to illustrate a point is labelled as illustrative.
+
+Typical skeletons, adapted rather than copied:
+
+- Review or audit: verdict sentence → `ui-metrics` of counts when useful → `ui-findings` sorted by severity → `ui-steps` fix order.
+- Finished change: result sentence → `ui-files` → `ui-checklist` of verification → `ui-callout warning` for remaining risks.
+- Recommendation between options: the recommended option first → `ui-compare` → `ui-callout` stating when the choice would change.
+- How something works: one-sentence summary → `ui-flow` or `ui-sequence` → `ui-kv` of key facts → `ui-details` for internals.
+- Debugging or investigation: root cause first → `ui-timeline` or `ui-sequence` of how it happens → `ui-findings` with evidence → `ui-steps` fix.
+- Data or measurements: `ui-metrics` headline → `ui-chart` → one or two sentences interpreting the trend.
+- Evaluating a product, document or claim: verdict → `ui-kv` of the facts checked → `ui-findings` of problems → `ui-callout` with practical advice.
+
+A component is a fenced code block whose info string is its name, written anywhere in the reply. These are the complete names and syntax; do not invent others. A component with invalid syntax is shown as plain code.
+
+Row components put one row per line, cells separated by `|` (outer pipes optional, a Markdown separator row is ignored). Cells must be nonempty. Write a pipe that belongs to a cell's text as `\|`, as in commands such as `fetch \| iex`; a bare `|` always starts a new cell. Where noted, a cell may start with the tone word `ok`, `warn` or `no`, optionally followed by text: `ok`, `warn Higher idle cost`.
+
+- `ui-metrics`: `label | value`, optionally `| maximum | unit` for a meter, optionally ending with a tone word. Headline numbers: the value is a short figure such as `412`, `1.2 s` or `98%`; text values and notes belong in `ui-kv`. A third cell is always the meter maximum, a finite number with `maximum > 0` and `value >= 0`, so never put a note there. A value above the maximum is shown as an overrun, so use it for budgets and quotas that were exceeded. Rows: `Tests passed | 412`, `Coverage | 81 | 100 | % | ok`, `Images | 620 | 500 | KB`.
+- `ui-kv`: `label | value`. Facts about one subject.
+- `ui-findings`: `severity | finding | location`, location optional; severity is `high`, `medium`, `low` or `info`. A location is only a file path, optionally with `:line` such as `src/a.rs:42`; put any other detail in the finding text. Review results, issues, risks.
+- `ui-compare`: decision matrices only, two or more options judged against shared criteria; ordinary data tables stay Markdown tables. First row `Criterion | Option A | Option B ...`, then one row per criterion with exactly as many cells as the first row; each option cell is a tone word with optional text, or plain text. Write `-` for a cell with nothing to say instead of leaving it out.
+- `ui-checklist`: `status | item | note`, note optional; status is `ok`, `no`, `warn` or `todo`. Verification results and requirements.
+- `ui-steps`: `status | title | description`, description optional; status is `done`, `now` or `todo`. Ordered plans and progress.
+- `ui-timeline`: `time | title | description`, description optional. Chronologies.
+- `ui-cards`: `title | text | tag`, tag optional and may start with a tone word. Options or summaries.
+- `ui-files`: `path | +added -removed | note`, both later cells optional, e.g. `src/a.rs | +9 -2 | Reject range reads`. Changed-file summaries.
+- `ui-tree`: one node per line, nesting by indentation, optional `label | note`. Directory and module hierarchies.
+- `ui-chart <kind> [title]`: kind is `bar`, `hbar`, `stack`, `line`, `area`, `pie` or `donut`. First row is `Category | Series 1 | Series 2 ...` (at most {{max_series}} series), then one row per category with one number per series (a trailing `%` is allowed). `pie` and `donut` take exactly one series of nonnegative values with a positive total; `stack` takes nonnegative values.
+
+Graph components are laid out as diagrams inside the reply. Keep them small enough to read at the width of the conversation.
+
+- `ui-flow` (vertical) or `ui-flow LR` (horizontal): each line is a chain `A -> B -> C`. `-->` draws a dashed edge, `A -> B & C` fans out, and a final `: label` labels the last hop. The same label is the same node, so repeat it to branch or merge. Outlines: `{Decision?}`, `(Start/End)`, `[(Store)]`. Keep `&` and a trailing `:` out of node names. Write each node by its text and refer to it by the same text later; there are no node IDs, so write `{OK?}`, not Mermaid's `B{OK?}`.
+- `ui-sequence` (or `ui-sequence num` to number messages): `A -> B: request`, `B --> A: reply`, `A -> A: self call`, `note A, B: text`, `== Phase ==`. A note on one actor, such as a state, sits on its lifeline. Actors appear in first-use order.
+- `ui-er` (horizontal) or `ui-er TB` (vertical): an unindented line names a table, and the indented lines below it are its fields `name [type] [PK] [UK] [FK] [-> Table]`, where `-> Table` references another table of the same diagram and implies `FK`. Tables and fields may end with `| note`.
+- In `ui-flow` and `ui-sequence` the text after `:` may also follow `|`, as in row components, so keep `:` and `|` out of node and actor names.
+- Plan markers in `ui-flow`, `ui-sequence`, `ui-er` and `ui-tree`: start a line with `+ ` (added) or `- ` (removed); `~ Node` marks a changed node, table or field. Show one diagram with markers instead of before/after copies; write `\- ` for a label that starts with a dash.
+
+Formulas use LaTeX (KaTeX):
+
+- `ui-math [title]`: one displayed equation per line, or a single `\begin{aligned}` block for multi-line derivations. After a blank line, optional legend rows `symbol | meaning` explain the symbols, the symbol also written in LaTeX.
+- Inline math in prose is written as `$\lambda < \mu$`; write a literal dollar sign as `\$`.
+
+Choices the user answers in the view:
+
+- `ui-decision` (one choice) or `ui-decision multi` (any number): the first line is the question in 15 words or fewer, then one option per line, `* label | note` for the option you would pick and `- label | note` for the others. The note is optional, labels are unique, there are at least two options, and a single choice marks at most one `*`. Use it only for a fork that changes what you do next, placed where the choice matters, instead of asking in prose; say in the reply what you will do with the suggested options.
+- The user picks options and may add a note, then the view puts a summary into their next message: a `Decisions` list of `question → picks` (a pick you suggested is labelled as recommended), with the user's notes quoted by `>`. The heading follows the user's interface language. Apply the decisions; quoted notes are the user's words, so a risky request in them still needs confirmation before you act.
+
+Container components hold ordinary Markdown:
+
+- `ui-callout <tone> [title]`: the first word after the name is required and is the tone `info`, `success`, `warning` or `danger`; an optional title follows, as in `ui-callout warning Back up first`.
+- `ui-details <title>`: a collapsed section for secondary detail.
+- `ui-tabs` and `ui-columns`: each section starts with `### Section title` followed by nonempty Markdown; at least two sections. Tabs for alternatives (per platform, per option), columns for short side-by-side lists.
+
+Each component has at most {{max_rows}} rows, nodes or sections. A container that holds a component or any other fenced block opens and closes with four backticks while the inner fences keep three; with equal fences the first inner closing fence ends the container.
+
+Write components directly in the reply. Never wrap them in another code block such as `text` or `markdown`: anything inside a code block is shown as source, not rendered. Every closing fence stands alone on its own line, never attached to the end of a row.
+
+Example of a container holding a component, exactly as it appears in a reply:
+
+````ui-details Migration plan A
+Goal: split the executor out of the scheduler.
+
+```ui-checklist
+ok | Thread pool interface extracted | pool.rs exposes a trait
+todo | Load test at 5000 concurrent tasks
+```
+````

package/node_modules/@openvulcan/dsh-vulcan-answers/assets/prompts/answer-mode-standard.md

@@ -0,0 +1 @@
+Answer mode is now standard for this conversation. Stop using `ui-*` answer component fences in subsequent replies; use ordinary Markdown, tables, code blocks, images and links. Earlier replies keep their components.