@toddzheng024/dscode-bundle 0.7.13 → 0.7.15

package/plugins/jev/approval.mjs

@@ -0,0 +1,109 @@
+// The approval question set and its decision policy. Jev returns calibrated
+// probabilities, per-option probabilities and a score, so the mapping below uses
+// signals an LLM reviewer cannot give us:
+//
+//   * allowing is the dangerous direction and needs a confident allow plus a low
+//     risk profile;
+//   * denying is only ever a request to stop, so a decisive deny is honoured —
+//     but a silent rejection must be well corroborated, which is why a deny needs
+//     either a decisive confidence *and* probability, or a slightly lower
+//     confidence plus a risk score that already crossed its ceiling;
+//   * a retained instruction that Jev reads as authorizing the exact action vetoes
+//     an automatic deny, because the cost of a wrong deny is work the user wanted
+//     and never got a prompt for.
+export const DEFAULT_THRESHOLDS = Object.freeze({
+  autoAllow: 0.85,
+  autoDeny: 0.95,
+  autoDenyProbability: 0.9,
+  autoDenyCorroborated: 0.9,
+  authorizedVeto: 0.6,
+  credentialRisk: 0.5,
+  destructiveCeiling: 2,
+});
+
+export const STATE_LIMIT = 8000;
+
+export const DESTRUCTIVE_LEVELS = Object.freeze([
+  'No effect beyond reading state',
+  'A local write that is easy to undo',
+  'A local write that is hard to undo, such as deleting or rewriting tracked work',
+  'Touches shared, remote or published state',
+]);
+
+export function approvalQuestions() {
+  return {
+    verdict: {
+      type: 'choice',
+      instructions: 'Should this tool call run now without asking the user first? Prefer ask when the action plausibly matches the instruction but you cannot tell; reserve deny for actions the instruction does not cover or that are unsafe.',
+      criteria: {
+        allow: 'Read-only, or a change the retained user instruction already asked for.',
+        ask: 'Plausibly within the task but not clearly authorized, or the blast radius is unclear.',
+        deny: 'Outside the user instruction, or it would disclose data, destroy unrelated work, or publish something.',
+      },
+    },
+    authorized: {
+      type: 'noul',
+      instructions: 'Does the retained user instruction explicitly authorize this exact action, including its target and effect?',
+    },
+    destructive: {
+      type: 'score',
+      instructions: 'If this action does the wrong thing, how hard is the damage to undo?',
+      criteria: [...DESTRUCTIVE_LEVELS],
+    },
+    credential_risk: {
+      type: 'noul',
+      instructions: 'Does this action read, print, transmit or embed credentials, tokens or other secrets?',
+    },
+  };
+}
+
+const clip = (value, limit) => {
+  const text = typeof value === 'string' ? value : JSON.stringify(value);
+  if (text === undefined) return '';
+  return text.length > limit ? `${text.slice(0, limit)}…[truncated]` : text;
+};
+
+// `state` carries what the decision needs and nothing else: the exact pending
+// call, and the retained direct user instruction. It is posted to OpenRouter, so
+// it is bounded and never carries credentials.
+export function approvalState({ action, context } = {}) {
+  const instructions = (context?.userMessages ?? [])
+    .map(message => (message?.content ?? []).map(block => block?.text ?? '').join(' ').trim())
+    .filter(Boolean)
+    .join('\n---\n');
+  return {
+    pendingToolCall: clip(action, STATE_LIMIT),
+    userInstructions: clip(instructions, STATE_LIMIT),
+  };
+}
+
+export function approvalVerdict(answers, thresholds = DEFAULT_THRESHOLDS) {
+  const verdict = answers?.verdict;
+  if (!verdict || verdict.type !== 'choice') return undefined;
+  const confidence = Number(verdict.confidence ?? 0);
+  const denyProbability = Number(verdict.probabilities?.deny ?? 0);
+  const destructive = Number(answers?.destructive?.score ?? 0);
+  const credentialRisk = Number(answers?.credential_risk?.noul ?? 0);
+  const authorized = Number(answers?.authorized?.noul ?? 0);
+  const detail = { confidence, denyProbability, authorized, destructive, credentialRisk, choice: verdict.choice };
+  const highRisk = credentialRisk >= thresholds.credentialRisk || destructive >= thresholds.destructiveCeiling;
+
+  // A confident deny is honoured unless the instruction looks like it authorized
+  // the action: a wrong deny blocks work the user asked for, silently.
+  const decisiveDeny = confidence >= thresholds.autoDeny && denyProbability >= thresholds.autoDenyProbability;
+  const corroboratedDeny = confidence >= thresholds.autoDenyCorroborated && highRisk;
+  if (verdict.choice === 'deny' && (decisiveDeny || corroboratedDeny)) {
+    if (authorized >= thresholds.authorizedVeto) {
+      return { decision: 'human', reason: 'Automatic review wanted to reject this, but the instruction appears to authorize it.', ...detail };
+    }
+    return { decision: 'deny', reason: 'Automatic review rejected the action as outside the task or unsafe.', ...detail };
+  }
+
+  // Everything below guards the allow direction: high risk or a non-allowing
+  // answer never runs without the human.
+  if (credentialRisk >= thresholds.credentialRisk) return { decision: 'human', reason: 'Automatic review found possible credential handling.', ...detail };
+  if (destructive >= thresholds.destructiveCeiling) return { decision: 'human', reason: 'Automatic review judged this action hard to undo.', ...detail };
+  if (verdict.choice !== 'allow') return { decision: 'human', reason: 'Automatic review asked for a human decision.', ...detail };
+  if (confidence < thresholds.autoAllow) return { decision: 'human', reason: `Automatic review was not confident enough (${confidence.toFixed(2)}).`, ...detail };
+  return { decision: 'allow', reason: 'Automatic review approved the action.', ...detail };
+}

package/plugins/jev/client.mjs

@@ -0,0 +1,74 @@
+// OpenRouter's alpha Decisions endpoint: one POST carries the state plus every
+// typed question, and the model answers them in a single pass. This is not the
+// chat-completions shape our llm provider uses, so it is a separate client.
+export const DEFAULT_ENDPOINT = 'https://openrouter.ai';
+export const DECISIONS_PATH = '/api/alpha/decisions';
+export const DEFAULT_MODEL = '~typesafe/jev-latest';
+export const QUESTION_TYPES = Object.freeze(['noul', 'choice', 'score']);
+export const MAX_CHOICE_OPTIONS = 255;
+export const SCORE_LEVELS = Object.freeze({ min: 2, max: 10 });
+
+export function decisionsUrl(endpoint = DEFAULT_ENDPOINT) {
+  const base = String(endpoint).replace(/\/+$/, '');
+  if (!URL.canParse(base)) throw new Error(`jev: endpoint must be a URL, got ${endpoint}`);
+  return base + DECISIONS_PATH;
+}
+
+// The request shape is validated here rather than trusted to the caller: a
+// malformed question set is rejected locally instead of burning a round trip.
+export function validateQuestions(questions) {
+  if (!questions || typeof questions !== 'object' || Array.isArray(questions)) throw new Error('jev: questions must be an object');
+  for (const [key, question] of Object.entries(questions)) {
+    if (!question || typeof question !== 'object') throw new Error(`jev: ${key} must be a question object`);
+    if (!QUESTION_TYPES.includes(question.type)) throw new Error(`jev: ${key} has unsupported type ${question.type}`);
+    if (typeof question.instructions !== 'string' || !question.instructions.trim()) throw new Error(`jev: ${key} needs instructions`);
+    if (question.type === 'noul') continue;
+    if (question.type === 'choice') {
+      const criteria = question.criteria;
+      if (!criteria || typeof criteria !== 'object' || Array.isArray(criteria)) throw new Error(`jev: ${key} choice needs a criteria map`);
+      const count = Object.keys(criteria).length;
+      if (count === 0) throw new Error(`jev: ${key} choice needs at least one option`);
+      if (count > MAX_CHOICE_OPTIONS) throw new Error(`jev: ${key} choice has ${count} options, the limit is ${MAX_CHOICE_OPTIONS}`);
+      continue;
+    }
+    const criteria = question.criteria;
+    if (!Array.isArray(criteria)) throw new Error(`jev: ${key} score needs an ordered criteria array`);
+    if (criteria.length < SCORE_LEVELS.min || criteria.length > SCORE_LEVELS.max) throw new Error(`jev: ${key} score needs ${SCORE_LEVELS.min}-${SCORE_LEVELS.max} ordered levels`);
+  }
+  return questions;
+}
+
+export function buildBody({ model = DEFAULT_MODEL, state, questions, sessionId }) {
+  validateQuestions(questions);
+  if (state === undefined || state === null) throw new Error('jev: state is required');
+  return { model, state, questions, ...(sessionId ? { session_id: String(sessionId).slice(0, 256) } : {}) };
+}
+
+export function readAnswers(body) {
+  if (!body || typeof body !== 'object') throw new Error('jev: response is not an object');
+  if (!body.answers || typeof body.answers !== 'object' || Array.isArray(body.answers)) throw new Error('jev: response is missing answers');
+  return { id: body.id, model: body.model, provider: body.provider, answers: body.answers, usage: body.usage ?? null };
+}
+
+export async function requestDecisions({
+  endpoint = DEFAULT_ENDPOINT, model = DEFAULT_MODEL, apiKey, state, questions, sessionId,
+  timeoutMs = 8000, signal, fetchImpl = globalThis.fetch,
+} = {}) {
+  if (!apiKey) throw new Error('jev: no API key resolved');
+  if (typeof fetchImpl !== 'function') throw new Error('jev: no fetch implementation available');
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error('jev: request timed out')), timeoutMs);
+  const composed = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+  try {
+    const response = await fetchImpl(decisionsUrl(endpoint), {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(buildBody({ model, state, questions, sessionId })),
+      signal: composed,
+    });
+    if (!response.ok) throw new Error(`jev: HTTP ${response.status}`);
+    return readAnswers(await response.json());
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/plugins/jev/index.mjs

@@ -0,0 +1,77 @@
+import z from '@deepseek-ai/schemastery';
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment';
+import { DEFAULT_ENDPOINT, DEFAULT_MODEL, requestDecisions } from './client.mjs';
+import { DEFAULT_THRESHOLDS, approvalQuestions, approvalState, approvalVerdict } from './approval.mjs';
+
+// Jev is a decisions model, not a chat model: it answers typed questions about
+// supplied state and never generates prose. The service below exposes exactly one
+// consumer so far — the automatic permission review — and stays inert unless the
+// deployment has an OpenRouter key, so mounting it changes nothing by itself.
+export const name = 'dscode-jev';
+
+export const Config = z.object({
+  enabled: z.boolean().default(true),
+  endpoint: z.string().default(DEFAULT_ENDPOINT),
+  model: z.string().default(DEFAULT_MODEL),
+  apiKeyEnv: z.string().role('credential-ref').default('OPENROUTER_API_KEY'),
+  timeoutMs: z.number().step(1).min(1).default(8000),
+  autoAllow: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.autoAllow),
+  autoDeny: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.autoDeny),
+  autoDenyProbability: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.autoDenyProbability),
+  autoDenyCorroborated: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.autoDenyCorroborated),
+  authorizedVeto: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.authorizedVeto),
+  credentialRisk: z.number().min(0).max(1).default(DEFAULT_THRESHOLDS.credentialRisk),
+  destructiveCeiling: z.number().min(0).default(DEFAULT_THRESHOLDS.destructiveCeiling),
+});
+
+export function resolveOptions(config = {}) {
+  if (config.endpoint !== undefined && !URL.canParse(String(config.endpoint))) throw new Error(`${name}: endpoint must be a URL`);
+  return {
+    enabled: config.enabled !== false,
+    endpoint: config.endpoint || DEFAULT_ENDPOINT,
+    model: config.model || DEFAULT_MODEL,
+    apiKeyEnv: credentialRef(config.apiKeyEnv || 'OPENROUTER_API_KEY'),
+    timeoutMs: config.timeoutMs ?? 8000,
+    thresholds: Object.fromEntries(Object.keys(DEFAULT_THRESHOLDS).map(key => [key, config[key] ?? DEFAULT_THRESHOLDS[key]])),
+  };
+}
+
+export function apply(ctx, config = {}) {
+  const options = resolveOptions(config);
+  const resolveKey = async () => {
+    const credentials = ctx.get('credentials');
+    if (credentials !== undefined) return (await credentials.resolve(options.apiKeyEnv))?.value || undefined;
+    return launchEnvironmentOf(ctx).get(options.apiKeyEnv)?.value || undefined;
+  };
+  const service = {
+    name,
+    model: options.model,
+    enabled: () => options.enabled,
+    configured: async () => options.enabled && (await resolveKey()) !== undefined,
+    // Returns a verdict, or undefined when Jev is unavailable, unconfigured, or
+    // failed. The caller keeps its own reviewer for that case, so a Jev outage
+    // degrades to the previous behaviour instead of allowing anything.
+    approval: async ({ action, context, sessionId, signal } = {}) => {
+      if (!options.enabled) return undefined;
+      const apiKey = await resolveKey();
+      if (!apiKey) return undefined;
+      const started = Date.now();
+      try {
+        const response = await requestDecisions({
+          endpoint: options.endpoint, model: options.model, apiKey,
+          state: approvalState({ action, context }), questions: approvalQuestions(),
+          sessionId, timeoutMs: options.timeoutMs, signal,
+        });
+        const verdict = approvalVerdict(response.answers, options.thresholds);
+        if (verdict === undefined) return undefined;
+        return { ...verdict, source: 'jev', model: response.model ?? options.model, usage: response.usage, durationMs: Date.now() - started };
+      } catch (error) {
+        ctx.logger.warn(`jev: ${error.message}`);
+        return undefined;
+      }
+    },
+  };
+  ctx.provide('jev', service);
+  return service;
+}

package/plugins/providers/catalog.mjs

@@ -7,6 +7,8 @@ export const PROVIDERS = Object.freeze([
   { id: 'deepseek-official', name: 'DeepSeek', aliases: ['deepseek', 'deepseek-official', 'official'], credentialRef: 'DEEPSEEK_API_KEY', defaultModel: 'deepseek-flash' },
   // The optional management key reads account data only; it cannot call models.
   { id: 'openrouter', name: 'OpenRouter', aliases: ['openrouter', 'open-router'], credentialRef: 'OPENROUTER_API_KEY', managementRef: 'OPENROUTER_MANAGEMENT_KEY', defaultModel: 'deepseek/deepseek-v4-flash' },
+  // The Grok subscription rail: the token is the local 'grok login', read-only (plugins/grok).
+  { id: 'grok', name: 'Grok', aliases: ['grok', 'xai', 'x-ai'], credentialRef: 'GROK_CLI_TOKEN', defaultModel: 'grok-4.6' },
 ]);
 
 // The pi-ai adapter served OpenRouter until 0.7.6, from this settings section.

package/plugins/session-metrics/view.mjs

@@ -2,6 +2,7 @@ import { readMetrics } from './store.mjs';
 import { t } from '../i18n/messages.mjs';
 import { estimateCost, peakEmoji } from './pricing.mjs';
 import { balanceNow, trustedNow } from './balance.mjs';
+import { grokSubscriptionNow } from '../grok/billing.mjs';
 import { sessionAverageTps } from './rate.mjs';
 import { providerOfHeader } from '../providers/catalog.mjs';
 let source;
@@ -58,6 +59,28 @@ export function displayWidth(text) {
   for (const char of text) width += ZERO_WIDTH.test(char) ? 0 : WIDE.test(char) ? 2 : 1;
   return width;
 }
+/**
+ * The money slot for the Grok subscription rail: a plan has credits and a reset time, not a
+ * bill. The percentage is optional (the server omits it for a period without usage), and an
+ * unread window shows the tier alone instead of a wrong number.
+ */
+export function grokFooterFact(subscription, locale = 'en', now = Date.now()) {
+  const parts = [subscription?.tier ?? 'Grok'];
+  const used = subscription?.usedPercent;
+  if (Number.isFinite(used)) parts.push((Number.isInteger(used) ? String(used) : used.toFixed(1)) + '% ' + t(locale, 'footer.grokUsed'));
+  const reset = resetStamp(subscription?.periodEnd, now);
+  if (reset !== undefined) parts.push(t(locale, 'footer.grokResets') + ' ' + reset);
+  return parts.join(' · ');
+}
+
+/** Local `MM-DD HH:MM` for a reset time, or undefined when the window is unknown or past. */
+function resetStamp(iso, now) {
+  const at = Date.parse(typeof iso === 'string' ? iso : '');
+  if (!Number.isFinite(at) || at <= now) return undefined;
+  const pad = value => String(value).padStart(2, '0');
+  const date = new Date(at);
+  return pad(date.getMonth() + 1) + '-' + pad(date.getDate()) + ' ' + pad(date.getHours()) + ':' + pad(date.getMinutes());
+}
 export function formatFooter(metrics, context, columns = 80, rates, locale = 'en', header = '', provider = providerOfHeader(header) ?? 'deepseek-official') {
   const label = key => t(locale, key);
   const ctx = Number.isFinite(context) ? `${Math.round(context)}%` : '--';
@@ -65,7 +88,7 @@ export function formatFooter(metrics, context, columns = 80, rates, locale = 'en
   // The balance belongs to the provider the header names; only DeepSeek's official route bills by a peak window.
   const balance = balanceNow(provider);
   const spend = metrics.unknown && metrics.cost === 0 ? '--' : `$${metrics.cost.toFixed(2)}${metrics.unknown ? '+' : ''}${metrics.pending ? '…' : ''}`;
-  const dollars = `${spend} / ${balance === null ? '$--' : '$' + balance.toFixed(2)}${provider === 'deepseek-official' ? ' ' + peakEmoji(trustedNow()) : ''}`;
+  const dollars = provider === 'grok' ? grokFooterFact(grokSubscriptionNow(), locale) : `${spend} / ${balance === null ? '$--' : '$' + balance.toFixed(2)}${provider === 'deepseek-official' ? ' ' + peakEmoji(trustedNow()) : ''}`;
   const base = rates ? [
     `${label('footer.current')}: ${Number.isFinite(rates.current) ? '~' + rates.current.toFixed(1) : '--'} tps`,
     `${label('footer.average')}: ${Number.isFinite(rates.average) ? rates.average.toFixed(1) : '--'} tps`,

package/plugins/tui-tools/hook-sources.mjs

@@ -0,0 +1,113 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { hookEvents, validateHooks } from './hooks.mjs';
+import { enabledFlag } from './workspace-discovery.mjs';
+
+// Project hook files layer on top of the installation file by default. They run as
+// the OS user outside tool approval, so a cloned repository can install gates;
+// DSCODE_PROJECT_HOOKS=0/off/false loads the installation file alone.
+// `.codex/hooks.json` and `.dsh/hooks.json` are the bridge's own shape;
+// `.claude/settings.json` keeps hooks under a top-level `hooks` key and is skipped
+// when that key is absent.
+export const projectHookFiles = Object.freeze([
+  { path: '.codex/hooks.json' },
+  { path: '.dsh/hooks.json' },
+  { path: '.claude/settings.json', nested: true },
+]);
+
+export const resolvedHookFile = 'hooks.resolved.json';
+export const hookReportFile = 'hooks.resolved.report.json';
+
+export function projectHooksEnabled(env = process.env) {
+  const value = env.DSCODE_PROJECT_HOOKS;
+  return value === undefined ? true : enabledFlag(value);
+}
+
+function extractHooks(parsed, nested) {
+  const hooks = parsed?.hooks !== undefined ? parsed.hooks : (nested ? undefined : parsed);
+  if (hooks === undefined) return undefined;
+  if (!hooks || typeof hooks !== 'object' || Array.isArray(hooks)) throw new Error('hooks must be an event map');
+  return hooks;
+}
+
+// The installation file is trusted and must fail loudly on anything this bridge
+// cannot run.
+export function readInstallationHooks(path) {
+  return validateHooks(JSON.parse(readFileSync(path, 'utf8')));
+}
+
+// A project file is only filtered: a Claude Code settings.json routinely carries
+// events this bridge does not implement, and skipping them must not stop dscode
+// from starting. Every skip is reported so it is visible rather than silent.
+export function readProjectHooks(path, { nested = false } = {}) {
+  const hooks = extractHooks(JSON.parse(readFileSync(path, 'utf8')), nested);
+  if (hooks === undefined) return undefined;
+  const kept = {};
+  const skipped = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!hookEvents.includes(event)) { skipped.push(event); continue; }
+    // A project file is untrusted input: a gate this bridge cannot run is dropped
+    // with its reason rather than allowed to stop dscode from starting.
+    try {
+      validateHooks({ hooks: { [event]: groups } });
+    } catch (error) {
+      const reason = error.message.startsWith(`${event}: `) ? error.message.slice(event.length + 2) : error.message;
+      skipped.push(`${event} (${reason})`);
+      continue;
+    }
+    kept[event] = groups;
+  }
+  return { hooks: Object.keys(kept).length ? kept : undefined, skipped };
+}
+
+export function resolveHookSources({ root, cwd = root, env = process.env }) {
+  const installation = join(root, 'config/hooks.local.json');
+  const sources = [{ path: installation, hooks: readInstallationHooks(installation) }];
+  const skipped = [];
+  if (!projectHooksEnabled(env)) return { sources, skipped };
+  for (const file of projectHookFiles) {
+    const path = join(cwd, file.path);
+    if (!existsSync(path)) continue;
+    let parsed;
+    try {
+      parsed = readProjectHooks(path, file);
+    } catch (error) {
+      // Unreadable JSON (a Claude settings file may even carry comments) is a
+      // report, not a startup failure, for a file dscode did not write.
+      skipped.push({ path: file.path, events: [`(not loaded: ${error.message})`] });
+      continue;
+    }
+    if (!parsed) continue;
+    if (parsed.skipped.length) skipped.push({ path: file.path, events: parsed.skipped });
+    if (parsed.hooks) sources.push({ path, hooks: parsed.hooks });
+  }
+  return { sources, skipped };
+}
+
+export function mergeHooks(sources) {
+  const hooks = {};
+  for (const source of sources) {
+    for (const [event, groups] of Object.entries(source.hooks ?? {})) hooks[event] = [...(hooks[event] ?? []), ...groups];
+  }
+  return { hooks };
+}
+
+// The pinned bridge takes one config path for the whole process, so layered files
+// are merged into a single resolved file. A single source stays where it is edited.
+export function writeHookConfig({ root, cwd = root, home, env = process.env }) {
+  const { sources, skipped } = resolveHookSources({ root, cwd, env });
+  const paths = sources.map(source => source.path);
+  const resolved = join(home, resolvedHookFile);
+  const report = join(home, hookReportFile);
+  if (sources.length === 1) {
+    // A stale merge must not outlive the layers it came from: /hooks reads the
+    // report, and a leftover one would describe sources that are no longer loaded.
+    if (existsSync(resolved)) rmSync(resolved);
+    if (existsSync(report)) rmSync(report);
+    return { path: sources[0].path, sources: paths, skipped };
+  }
+  mkdirSync(home, { recursive: true });
+  writeFileSync(resolved, JSON.stringify(mergeHooks(sources), null, 2) + '\n', { mode: 0o600 });
+  writeFileSync(report, JSON.stringify({ sources: paths, skipped }, null, 2) + '\n', { mode: 0o600 });
+  return { path: resolved, sources: paths, skipped };
+}

package/plugins/tui-tools/index.mjs

@@ -1,7 +1,8 @@
 import { runShell } from './shell.mjs';
 import { VERSION_PATTERN, scheduleUpdate } from './update.mjs';
 import { readLanguage, t } from '../i18n/messages.mjs';
-import { readFile, readdir, access } from 'node:fs/promises';
+import { hookReportFile } from './hook-sources.mjs';
+import { readFile, readdir, access, stat } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
@@ -63,6 +64,22 @@ export async function findConflicts(cwd, configs, winners, env = process.env) {
   return [...lines, ...errors, 'Scope: filesystem roots only; runtime/remote provider shadowed candidates are not exposed by DSH.'].join('\n');
 }
 
+// The pinned bridge reads one merged file for the whole process, and /hooks reload
+// remounts the plugin with the same path, so an edited layer is not picked up until
+// dscode restarts. Report that instead of letting the user believe the edit is live.
+export async function staleLayers(resolvedPath, sources = []) {
+  const mergedAt = await stat(resolvedPath).then(value => value.mtimeMs).catch(() => undefined);
+  if (mergedAt === undefined) return [];
+  const stale = [];
+  for (const source of sources) {
+    if (source === resolvedPath) continue;
+    const at = await stat(source).then(value => value.mtimeMs).catch(() => undefined);
+    if (at === undefined) stale.push(`${source} (missing)`);
+    else if (at > mergedAt) stale.push(`${source} (newer than the merge)`);
+  }
+  return stale;
+}
+
 export function apply(ctx) {
   const diagnosticsHome = process.env.DSH_HOME ?? process.env.DSCODE_HOME;
   // A minimal composition (and the unit fixtures) may mount no logger; diagnostics are best-effort.
@@ -196,6 +213,8 @@ export function apply(ctx) {
     const path = hookPath(entry);
     const raw = JSON.parse(await readFile(path, 'utf8'));
     const hooks = raw.hooks ?? raw;
-    return ok(`Hooks: ${state(entry)}\nConfig: ${path}\n${Object.entries(hooks).map(([event, groups]) => `${event}: ${hookEvents.includes(event) ? 'supported' : 'UNSUPPORTED'}; ${Array.isArray(groups) ? groups.length : 0} groups`).join('\n')}\nSupported: ${hookEvents.join(', ')}\nOnly synchronous command hooks. Runs as your OS user, outside tool approval. Edit only trusted installation-owned config; /hooks reload applies it. No project hook auto-loading.\nPreCompact/PostCompact, PermissionRequest and subagent events are not supported by this bridge.`);
+    const report = await readFile(join(dirname(path), hookReportFile), 'utf8').then(JSON.parse).catch(() => undefined);
+    const stale = report ? await staleLayers(path, report.sources) : [];
+    return ok(`Hooks: ${state(entry)}\nConfig: ${path}\n${Object.entries(hooks).map(([event, groups]) => `${event}: ${hookEvents.includes(event) ? 'supported' : 'UNSUPPORTED'}; ${Array.isArray(groups) ? groups.length : 0} groups`).join('\n')}\nSupported: ${hookEvents.join(', ')}\nOnly synchronous command hooks. Runs as your OS user, outside tool approval. Edit only trusted installation-owned config; /hooks reload applies it. Project files (.codex/hooks.json, .dsh/hooks.json, .claude/settings.json) layer on top unless DSCODE_PROJECT_HOOKS=0; events this bridge does not support are skipped rather than fatal, and any edit to a layer needs a restart.${report ? `\nLayers: ${report.sources.join(', ')}${report.skipped.length ? `\nSkipped by this bridge: ${report.skipped.map(entry => `${entry.path}: ${entry.events.join(', ')}`).join('; ')}` : ''}` : ''}${stale.length ? `\nNeeds restart: ${stale.join('; ')} — /hooks reload re-reads the merged file, not its sources.` : ''}\nPreCompact/PostCompact, PermissionRequest and subagent events are not supported by this bridge.`);
   });
 }

package/plugins/tui-tools/update.mjs

@@ -34,7 +34,9 @@ export async function fetchLatestVersion({ fetchImpl = fetch, timeoutMs = 8000 }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetchImpl(REGISTRY_URL, { headers: { accept: 'application/vnd.npm.install-v1+json' }, signal: controller.signal });
+    // Plain JSON: the registry answers 406 for the abbreviated metadata type on the
+    // `/latest` dist-tag endpoint.
+    const response = await fetchImpl(REGISTRY_URL, { headers: { accept: 'application/json' }, signal: controller.signal });
     if (!response.ok) return undefined;
     const version = (await response.json())?.version;
     return typeof version === 'string' && VERSION_PATTERN.test(version) ? version : undefined;

package/plugins/tui-tools/workspace-discovery.mjs

@@ -0,0 +1,122 @@
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+
+// Discovery above the project root, bounded at the home directory rather than the
+// filesystem root: a shared workspace directory such as ~/Workspace can contribute
+// skills and instructions to every project below it, while nothing outside the
+// operator's own tree can.
+export const ancestorSkillRoots = Object.freeze(['.dsh/skills', '.agents/skills', '.claude/skills']);
+export const instructionFileCandidates = Object.freeze(['AGENTS.md', 'CLAUDE.md']);
+export const projectRootMarkers = Object.freeze(['.git']);
+
+export const ENABLED_VALUES = Object.freeze(['1', 'true', 'on', 'yes']);
+// Fail closed: only the documented enable spellings arm a switch, so an operator
+// writing "no", "none" or "disable" cannot accidentally turn on a feature that
+// reads untrusted project content.
+export const enabledFlag = (value) => ENABLED_VALUES.includes(String(value ?? '').trim().toLowerCase());
+export const skillAncestorsEnabled = (env = process.env) => enabledFlag(env.DSCODE_SKILL_ANCESTORS);
+
+// A symlinked $HOME (or a /Volumes mount) must not break the boundary test: the
+// launcher passes an already-resolved session directory while os.homedir() returns
+// whatever $HOME says, so the comparison canonicalizes both sides. The chain itself
+// keeps the caller's logical paths, which is what the skill and instruction probes
+// then stat.
+const canonical = path => { try { return realpathSync(path); } catch { return resolve(path); } };
+
+// Every directory from the working directory up to home, nearest first. An empty
+// list means home is not an ancestor, and the mode then contributes nothing.
+export function ancestorChain({ cwd, home }) {
+  const start = resolve(cwd);
+  const stop = resolve(home);
+  const canonicalStop = canonical(stop);
+  const canonicalStart = canonical(start);
+  if (canonicalStart !== canonicalStop && !canonicalStart.startsWith(canonicalStop + sep)) return [];
+  const chain = [];
+  for (let current = start; ;) {
+    chain.push(current);
+    if (canonical(current) === canonicalStop) break;
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return chain;
+}
+
+export function projectRootOf({ cwd, markers = projectRootMarkers }) {
+  const start = resolve(cwd);
+  for (let current = start; ;) {
+    if (markers.some(marker => existsSync(join(current, marker)))) return current;
+    const parent = dirname(current);
+    if (parent === current) return start;
+    current = parent;
+  }
+}
+
+export function ancestorSkillDirs({ cwd, home, env = process.env }) {
+  if (!skillAncestorsEnabled(env)) return [];
+  const projectRoot = projectRootOf({ cwd });
+  const dirs = [];
+  for (const dir of ancestorChain({ cwd, home })) {
+    for (const root of ancestorSkillRoots) {
+      // The provider already scans these two at rank 100/200 for the owning project.
+      if (dir === projectRoot && (root === '.dsh/skills' || root === '.agents/skills')) continue;
+      const path = join(dir, root);
+      if (existsSync(path) && !dirs.includes(path)) dirs.push(path);
+    }
+  }
+  return dirs;
+}
+
+// Instruction files strictly above the project root, farthest first so the chain
+// still reads broad to specific. The project chain itself stays upstream's job.
+export function ancestorInstructionFiles({ cwd, home }) {
+  const chain = ancestorChain({ cwd, home });
+  // The chain runs from the working directory outward, so everything after the
+  // project root is above it; reversing restores broad-to-specific order.
+  const stop = chain.indexOf(projectRootOf({ cwd }));
+  const above = (stop === -1 ? chain : chain.slice(stop + 1)).reverse();
+  const files = [];
+  for (const dir of above) {
+    for (const name of instructionFileCandidates) {
+      const path = join(dir, name);
+      if (existsSync(path)) files.push(path);
+    }
+  }
+  return files;
+}
+
+// The provider ignores a source file that cannot fit its render budget, and the
+// aggregate below occupies the broadest (user-global) slot: without a bound, one
+// oversized ancestor file would take the user-global instructions down with it.
+// Stay under the preset's 64 KiB maxBytes with headroom.
+export const AGGREGATE_BUDGET_BYTES = 60 * 1024;
+
+// The upstream provider owns exactly one user-global instruction file, so ancestor
+// files are folded in behind it. With no ancestor file this writes nothing and
+// changes nothing: the provider keeps reading $DSH_HOME/AGENTS.md where it always did.
+// The user-global file is always written: dropping it in favour of its descendants
+// would silently replace what the user wrote with what the project wrote. Ancestors
+// are then added nearest-first while the budget allows, and a source that would
+// overflow is skipped whole rather than truncated mid-file.
+export function writeWorkspaceInstructions({ cwd, home, stateDir }) {
+  const files = ancestorInstructionFiles({ cwd, home });
+  if (!files.length) return undefined;
+  const userGlobal = join(stateDir, 'AGENTS.md');
+  const texts = new Map();
+  if (existsSync(userGlobal)) texts.set(userGlobal, readFileSync(userGlobal, 'utf8').trim());
+  for (const file of files) texts.set(file, readFileSync(file, 'utf8').trim());
+  const written = [...texts.keys()];
+  const priority = written[0] === userGlobal ? [userGlobal, ...written.slice(1).reverse()] : [...written].reverse();
+  const kept = new Set();
+  let bytes = 0;
+  for (const source of priority) {
+    const size = Buffer.byteLength(texts.get(source), 'utf8') + 2;
+    if (kept.size > 0 && bytes + size > AGGREGATE_BUDGET_BYTES) continue;
+    kept.add(source);
+    bytes += size;
+  }
+  const directory = join(stateDir, 'workspace-instructions');
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(join(directory, 'AGENTS.md'), written.filter(source => kept.has(source)).map(source => texts.get(source)).join('\n\n') + '\n', { mode: 0o600 });
+  return directory;
+}