@try-works/dsh-tool-mode 0.0.0-stage → 0.5.45

package/LICENSE

@@ -0,0 +1,205 @@
+Copyright 2026 Try Works
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -1,3 +1,304 @@
-# Temporary Holding Version
+# dsh-tool-mode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> **User documentation:** [docs/guide](../../docs/guide/index.md) — install, first
+> call, MCP, extensions, custom tools, security and troubleshooting.
+
+Install on-device models as DSH tools and skills, with per-platform capability
+gating. Ships with the [Desert Ant Labs](https://desertant.com/models/) catalog.
+
+A DSH agent gets a real tool for every model that can run in its process, a
+skill that teaches it *when* to reach for that tool, and an honest explanation
+for every model that cannot run — instead of a tool that fails at call time.
+
+## What it does
+
+The plugin composes six layers:
+
+1. **Catalog** (`catalog/desert-ant-models.json`) — all 18 Desert Ant models,
+   their inputs, outputs, language counts and the npm package that runs them.
+2. **Capability resolver** (`src/capability.ts`) — decides, per model, whether it
+   can actually run *in this process*, and why not when it cannot.
+3. **Adapters** (`src/adapters/`) — lazily import a model package and invoke it.
+4. **Transports** (`src/transport.ts`) — reach a model this machine cannot run:
+   through the Desert Ant CLI, or through a bridge on a machine that can.
+5. **Registrar** (`src/registrar.ts`) — turns each reachable model into a
+   `defineTool` definition registered on `ctx.tools`.
+6. **Skills** (`src/skills.ts` + `catalog/playbooks.json`) — publishes one skill
+   per registered tool describing when to use it, when not to, and how.
+
+Nothing is imported from a model package at plugin load, so a deployment that
+installs none of them still starts cleanly and reports exactly what is missing.
+
+## Tools it registers
+
+| Tool | Model | Runs on Windows x64 | Notes |
+| --- | --- | --- | --- |
+| `lang_detect` | Tongue | **yes** | Pure JavaScript, 2 MB model inside the package, no network |
+| `stt_transcribe` | Voz | **yes** | Needs `onnxruntime-node`; ~349 MB weights download on first use |
+| `tool_mode_list` / `tool_mode_describe` | — | yes | Discovery: live readiness, schemas, and unsupported cases |
+| `model_tools` | — | yes | Host-local management view |
+
+The other 16 catalog models are reported by `model_tools` with the exact reason
+they cannot run, for example:
+
+```
+- [unavailable] redact (`redact_pii`): On-device redaction that strips personal
+  data as you type, in 27 languages, with restore support.
+  why not: Redact has no prebuilt native build for win32-x64; @desert-ant-labs/redact/native
+  ships one for linux-x64, linux-arm64 and darwin-arm64 only.
+```
+
+## Reaching the other 16 models
+
+A model only needs a route, not a rewrite. Two routes cover the rest.
+
+### The CLI (macOS and Linux)
+
+Every shipping model is `desertant <verb> … --json`, so wherever the CLI is
+installed the plugin will drive it. Nothing to configure — it is detected on
+PATH:
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/Desert-Ant-Labs/desert-ant-cli/main/install.sh | sh
+```
+
+That immediately makes Redact, Emo, Gist, Clear, Ear, Moderator, Shapes, Align,
+Tongue and Voz callable on that machine.
+
+### The bridge (an Apple machine, for Apple-only models)
+
+Title and Uhm run only on Apple silicon. Run the reference bridge there and point
+the plugin at it:
+
+```sh
+# on the Mac
+node scripts/desert-ant-bridge.mjs --token "$(openssl rand -hex 16)"
+```
+
+```yaml
+- id: model-tools
+  config:
+    remote:
+      endpoint: http://mac-studio.local:8787
+      token: <the token>
+```
+
+`suggest_title` then registers here with `route: remote`, and the existing
+catalog entry, parameter schema and skill apply unchanged. The bridge is a thin
+wrapper over the CLI; it binds to loopback and requires a token. **The plugin
+does not host anything** — the licence forbids re-hosting the models as a
+service, so the bridge must be your own machine.
+
+## Installing tools at run time
+
+`model_tools` actions: `list`, `installed`, `describe <id>`, `enable <id>`,
+`disable <id>`, `reset [<id>]`.
+
+**Enable and disable are remembered across restarts.** A plugin `config` states
+the *deployment* default; `enable`/`disable` record the *user's* choice on top of
+it:
+
+- `disable` always wins, so a user can turn off something the config ships.
+- `enable` adds to the config selection, so a user can turn something on without
+  editing YAML.
+- `reset` forgets the choice and makes the configuration authoritative again.
+
+Choices are stored as JSON at `<DSH_HOME>/model-as-tool/state.json`, written
+through a temporary file and a rename so a crash cannot leave a truncated
+document that reads as "everything is gone".
+
+```json
+{ "enabled": ["voz"], "disabled": ["tongue"] }
+```
+
+The plugin writes its own state file rather than rewriting your
+`cordis.patch.yml`: a rewrite there would fight the profile's reload and could
+clobber comments you wrote. Point it elsewhere with `stateFile`, or set
+`persist: false` for the earlier session-scoped behaviour.
+
+Enabling a model that cannot run here fails with the resolver's reason and
+nothing is written — persisting a failed enable would install it silently on the
+next start.
+
+## Install
+
+The package is a DSH bundle: `package.json` declares
+`dsh.bundle.patch: ./cordis.patch.yml`, and that patch is the single `insert`
+row a profile mounts. Install it with `plugin_manager`'s `install_bundle`
+action, or copy the row from [`cordis.patch.yml`](cordis.patch.yml) into the
+profile's own patch file.
+
+The package builds itself on install: `prepare` runs `tsc` from `src/` into
+`lib/`, which is the entry point `main` and `exports` advertise. A registry
+tarball ships `lib/` prebuilt by `prepack`, so a consumer needs no toolchain.
+
+Model packages are **optional dependencies**: install only the ones you want.
+
+```sh
+npm i @desert-ant-labs/tongue                 # language detection, works everywhere
+npm i @desert-ant-labs/voz onnxruntime-node   # transcription on Windows/Linux/macOS
+```
+
+The plugin never bundles or re-hosts model weights.
+
+## What gets downloaded, and when
+
+Three separate things arrive at three separate times. Measured sizes are from a
+Windows x64 install of this package.
+
+**1. The plugin itself — ~58 kB, from npm, at install.** `lib/`, the two catalog
+JSON files, `cordis.patch.yml` and this README. It contains **no model weights
+and no inference runtime**.
+
+**2. The model SDK packages — from npm, at install, only if you asked for them.**
+They are `optionalDependencies`, so a failed or skipped download does not fail the
+install; the capability resolver simply reports the model as unavailable.
+
+| Package | Size on disk | Contains |
+| --- | --- | --- |
+| `@desert-ant-labs/tongue` | 2.1 MB | **The model itself** — `tongue_int8.bin` (2.0 MB) ships inside the tarball |
+| `@desert-ant-labs/voz` | 44.2 MB | The WebAssembly runtime (`VozWeb.wasm`), not the weights |
+| `onnxruntime-node` | 287.1 MB | The prebuilt inference engine for this platform |
+
+**3. The weights — from Hugging Face, on first call, not at install.** Each SDK
+pins one revision and verifies the download, then caches it. Voz fetches about
+**367 MB** on its first transcription:
+
+```
+~/.cache/desert-ant-models/desert-ant-labs/voz      367 MB   (first call)
+```
+
+Tongue never downloads anything: its model is inside the npm package.
+
+Point an SDK at a pre-populated folder to run offline (each adapter accepts a
+`directory`), and set `HF_TOKEN` for a gated repo. Because the licence forbids
+redistribution, the plugin never bundles or mirrors weights — it downloads them
+the way the vendor intends, once, into the vendor's own cache.
+
+### Install cost is real, so it is opt-out
+
+Installing with the optional dependencies present pulls roughly **333 MB** before
+any model runs, and a first Voz call adds **367 MB** more. If that is unwanted,
+install the plugin with them skipped and add only what you use:
+
+```sh
+npm i @try-works/dsh-tool-mode --omit=optional
+npm i @desert-ant-labs/tongue        # 2 MB, and its model is included
+```
+
+**Watch out for the other model packages.** They ship prebuilt native cores for
+`linux-x64`, `linux-arm64` and `darwin-arm64` inside one tarball — roughly 50 MB
+each — so `@desert-ant-labs/redact` is ~166 MB of which the great majority is
+Linux and macOS binaries that can never load on Windows. Installing one on
+Windows buys ~130 MB that cannot run.
+
+## Development
+
+```sh
+npm install          # devDependencies: tsc, tsx, and the two model packages
+npm run link:dsh     # point @deepseek-ai/* peers at a DSH checkout
+npm run verify       # typecheck -> build -> 35 tests -> built-artifact check
+```
+
+`link:dsh` exists because `@deepseek-ai/*` are **peer** dependencies — DSH
+supplies them at runtime, so locally they must be pointed at a checkout:
+
+```sh
+node scripts/link-dsh.mjs --checkout /path/to/deepseek-harness
+```
+
+Run it again after any `npm install`: npm prunes anything in `node_modules` it
+does not own, which includes those links.
+
+`npm run verify` ends with `verify:built`, which loads `lib/index.js` — resolved
+through the package's own `main`, under plain Node with no TypeScript loader —
+and runs a real inference. That is the artifact DSH loads, so it is the only
+build whose behaviour proves the plugin is installable; passing tests against
+`src/` under `tsx` does not.
+
+| Command | Purpose |
+| --- | --- |
+| `npm run demo` | Mount the plugin on a real context and print what it registered |
+| `npm run gating` | Print the resolved route for every catalogued model |
+| `npm run gen-docs` | Regenerate the data-derived docs from the catalog |
+| `npm run bridge` | Run the reference bridge for an Apple/Linux machine |
+
+Tests always mount through `tests/helpers.ts`, which points the durable state at
+a throwaway directory. That is not cosmetic: the plugin writes user choices into
+`DSH_HOME` by default, so an unisolated test would edit the developer's real
+configuration and a later test would read those edits as a user decision.
+
+## Configuration
+
+```yaml
+- id: model-tools
+  name: '@try-works/dsh-tool-mode'
+  config:
+    models: []              # empty = every runnable model; or list ids, e.g. [tongue]
+    exclude: []             # ids to drop after `models`
+    exposeUnavailable: false # true registers tools that will fail at call time
+    registerSkills: true
+    registerControlTool: true
+    persist: true           # remember enable/disable across restarts
+    # stateFile: /path/to/state.json   # default <DSH_HOME>/model-as-tool/state.json
+    allowNpm: true          # false forces the CLI/bridge routes
+    cli:
+      enabled: true         # use the Desert Ant CLI when it is on PATH
+      command: desertant
+    remote:
+      endpoint: ''          # a bridge on a machine that can run what this one cannot
+      token: ''
+    # catalogFile: /path/to/other-catalog.json
+    # playbookFile: /path/to/other-playbooks.json
+```
+
+## Platform support
+
+This is the part that matters most, because Desert Ant's Node prebuilds cover
+`linux-x64`, `linux-arm64` and `darwin-arm64` — **not `win32-x64`**.
+
+| Tier | Models | How |
+| --- | --- | --- |
+| Runs in plain Node everywhere | Tongue | Pure JS, no WASM, no inference runtime |
+| Runs where ONNX Runtime runs | Voz | `onnxruntime-node` ships win32-x64 binaries |
+| Prebuilt for linux/darwin only | Redact, Emo, Gist, Clear, Ear, Moderator, Shapes, Align | `/native` subpath |
+| Apple only (Core ML / MLX) | Title, Uhm | Swift SDK; no JS or Kotlin SDK |
+| Closed beta, no SDK | Schemer, Toxic, Who, Eye, Face | Weights on Hugging Face, nothing ships them |
+
+The browser/WASM entry of the LiteRT models explicitly refuses to run in plain
+Node ("needs a browser/Worker environment"), so it is not a fallback.
+
+## Licensing
+
+The Desert Ant Labs models are under the
+[Source-Available License 1.0](https://license.desertant.com/1.0) — not an
+open-source license. Inference is unlimited and free below 100,000 monthly active
+devices **per platform, per model**; above that a commercial license is required.
+Attribution ("Powered by Desert Ant Labs", linked) is required, and the models
+may not be redistributed or re-hosted as a standalone product or service.
+
+That is exactly why this plugin is an installer/wrapper: it loads the official
+npm packages locally and never ships, mirrors or proxies the weights.
+
+## Tests
+
+```sh
+npm run verify        # from the repository root
+```
+
+The suite boots the plugin on a real Cordis context with the shipping
+`ToolRuntime`, `SystemPrompt` and `SkillRegistry`, then drives the registered
+tools through `ctx.tools.execute` — including a real Tongue inference. The
+transport suite injects its command runner and HTTP poster, so the CLI and bridge
+failure paths are covered without a process or a socket.
+
+The tracked requirements and acceptance evidence are summarized in
+[verification/FINAL-REPORT.md](../../verification/FINAL-REPORT.md).
+
+## Design notes
+
+- See [docs/model-as-tool-architecture.md](../../docs/model-as-tool-architecture.md)
+  for the full design.
+- See [docs/adding-a-model.md](../../docs/adding-a-model.md) to add a model.
+- See [docs/model-tool-playbook.md](../../docs/model-tool-playbook.md) for the
+  per-model use cases, tool shapes and skill content.

package/bin/dsh-tool-mode-credentials.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * The `dsh-tool-mode-credentials` executable (SEC-01).
+ *
+ * The HUMAN-ONLY credential surface: the model-visible `model_tools`
+ * management action refuses generation (a generated secret must never enter a
+ * model transcript), and this CLI is the operator's terminal instead. The
+ * stream discipline is the stdio bridge's own: STDOUT carries the credential
+ * (the secret exactly once) and nothing else; diagnostics and usage go to
+ * stderr. The secret is never logged and never recoverable.
+ */
+
+import { runCredentialsCli } from '../lib/mcp/credential-cli.js'
+
+const exit = runCredentialsCli(process.argv.slice(2), {
+  out: line => process.stdout.write(`${line}\n`),
+  err: line => process.stderr.write(`${line}\n`),
+})
+
+process.exit(exit)

package/bin/dsh-tool-mode-mcp-stdio.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * The `dsh-tool-mode-mcp-stdio` executable (MCP-03, P26-08).
+ *
+ * This file owns the one property that cannot be tested from the library: that
+ * STDOUT CARRIES PROTOCOL TRAFFIC AND NOTHING ELSE. Everything written here goes
+ * through two explicitly separate streams, and nothing in this process writes to
+ * stdout except a protocol frame — not a banner, not a version, not a warning.
+ *
+ * The endpoint and token come from the environment, which is how an MCP client
+ * launches a stdio server. A missing token is reported on STDERR and the process
+ * exits non-zero: an unattended launch must fail with guidance rather than hang
+ * waiting for a credential nobody will supply (P26-16).
+ */
+
+import { createStdioBridge } from '../lib/mcp/stdio.js'
+
+const url = process.env.DSH_TOOL_MODE_MCP_URL ?? 'http://127.0.0.1:3765/mcp'
+const token = process.env.DSH_TOOL_MODE_MCP_TOKEN
+
+/** Diagnostics. NEVER stdout. */
+const diagnostic = line => process.stderr.write(`${line}\n`)
+
+if (token === undefined || token.length === 0) {
+  // P26-16: unattended operation must fail with setup guidance, never hang.
+  diagnostic('dsh-tool-mode-mcp-stdio: no credential configured.')
+  diagnostic('  Set DSH_TOOL_MODE_MCP_TOKEN to the token the operator configured for this client,')
+  diagnostic('  and DSH_TOOL_MODE_MCP_URL if the endpoint is not http://127.0.0.1:3765/mcp.')
+  process.exit(2)
+}
+
+const bridge = createStdioBridge(
+  {
+    url,
+    token,
+    fetch: async (target, init) => {
+      const response = await fetch(target, {
+        method: init.method,
+        headers: init.headers,
+        body: init.body,
+        signal: init.signal,
+      })
+      const headers = {}
+      response.headers.forEach((value, key) => { headers[key] = value })
+      return { status: response.status, headers, body: await response.text() }
+    },
+  },
+  {
+    // The ONLY writer to stdout in this process.
+    protocol: line => process.stdout.write(`${line}\n`),
+    diagnostic,
+  },
+)
+
+// Newline-delimited input. Chunk boundaries are not frame boundaries, so a partial
+// line is buffered until its newline arrives.
+let buffer = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+  buffer += chunk
+  let index = buffer.indexOf('\n')
+  while (index !== -1) {
+    const line = buffer.slice(0, index)
+    buffer = buffer.slice(index + 1)
+    void bridge.handleLine(line).then(output => {
+      if (output !== undefined) process.stdout.write(`${output}\n`)
+    }).catch(error => {
+      // A bridge fault is a diagnostic; the protocol channel stays clean.
+      diagnostic(`bridge error: ${error instanceof Error ? error.message : String(error)}`)
+    })
+    index = buffer.indexOf('\n')
+  }
+})
+
+process.stdin.on('end', () => {
+  // P26-08: EOF shuts down BRIDGE-OWNED requests without killing the shared host.
+  bridge.close()
+  diagnostic('stdin closed; bridge-owned requests aborted')
+  process.exit(0)
+})