@xmoon76/dsh-pi-tui 0.3.3 → 0.3.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmoon76/dsh-pi-tui",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "The dsh-pi-tui bundle: a TUI surface for DeepSeek Harness profiles (dsh --profile pi-tui)",
   "license": "MIT",
   "author": "XMoon <xmoonox@gmail.com>",
@@ -172,7 +172,8 @@
     "smoke:examples": "node scripts/examples-plugin-smoke.mjs",
     "pack:release": "rm -f xmoon76-dsh-pi-tui-*.tgz && pnpm pack --pack-destination .",
     "smoke:pack": "node scripts/tarball-smoke.mjs",
-    "verify:prepush": "pnpm typecheck:fork && pnpm test:fork && pnpm test:docs && node scripts/naming-gate.mjs && pnpm audit --prod --audit-level high && pnpm pack:release",
-    "verify:prepush:nofork": "pnpm test:docs && node scripts/naming-gate.mjs && pnpm audit --prod --audit-level high && pnpm pack:release"
+    "verify:prepush": "pnpm typecheck:fork && pnpm test:fork && pnpm test:docs && node scripts/naming-gate.mjs && pnpm gate:boundary && pnpm audit --prod --audit-level high && pnpm pack:release",
+    "verify:prepush:nofork": "pnpm test:docs && node scripts/naming-gate.mjs && pnpm gate:boundary && pnpm audit --prod --audit-level high && pnpm pack:release",
+    "gate:boundary": "node scripts/client-boundary-gate.mjs"
   }
 }

package/scripts/client-boundary-baseline.json

@@ -0,0 +1,82 @@
+{
+ "commands.ts": [
+  "import:dsh-agent",
+  "import:dsh-session"
+ ],
+ "index.ts": [
+  "agentDefaultModel",
+  "agentPresets",
+  "agents",
+  "attachments",
+  "authorization",
+  "commands",
+  "credentials",
+  "import:dsh-agent",
+  "import:dsh-session",
+  "jobs",
+  "llm",
+  "permissionPresets",
+  "sessionPersistence",
+  "sessions",
+  "settings",
+  "shell",
+  "subagents",
+  "tokenMeter",
+  "tools"
+ ],
+ "model-menu.ts": [
+  "import:dsh-agent"
+ ],
+ "present.ts": [
+  "import:dsh-session"
+ ],
+ "preset-events.ts": [
+  "import:dsh-session"
+ ],
+ "rewind.ts": [
+  "import:dsh-session"
+ ],
+ "runtime/direct/interaction-direct.ts": [
+  "approval",
+  "userQuestions"
+ ],
+ "runtime/direct/session-direct.ts": [
+  "sessionPersistence",
+  "sessionQuery"
+ ],
+ "runtime/direct/session-lifecycle-direct.ts": [
+  "agents",
+  "import:dsh-agent",
+  "import:dsh-session"
+ ],
+ "runtime/direct/session-writer-direct.ts": [
+  "sessionTitle"
+ ],
+ "runtime/direct/subagent-direct.ts": [
+  "subagents"
+ ],
+ "session-fork.ts": [
+  "import:dsh-agent",
+  "import:dsh-session"
+ ],
+ "sessions.ts": [
+  "import:dsh-session"
+ ],
+ "skill-catalog-refresh.ts": [
+  "import:dsh-agent"
+ ],
+ "skill-catalog.ts": [
+  "agentPresets",
+  "skills"
+ ],
+ "stats.ts": [
+  "import:dsh-session"
+ ],
+ "surface-catalog.ts": [
+  "commands",
+  "import:dsh-agent"
+ ],
+ "transcript.ts": [
+  "import:dsh-session"
+ ]
+}

package/scripts/client-boundary-gate.mjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+/**
+ * @xmoon76/dsh-pi-tui/scripts/client-boundary-gate — CI guard for the
+ * server/client migration (AGENTS.md "Server/client migration guardrails
+ * (hard rules)"): new feature code must not add direct Host coupling outside
+ * the approved boundary. The gate is "baseline allowlist + no-new-debt": the
+ * current (file, pattern) pairs are frozen in
+ * scripts/client-boundary-baseline.json, and any NEW pair fails. Existing
+ * coupling may stay on the allowlist until its owning migration phase moves
+ * it (docs/client-server-coupling.md); the baseline is updated deliberately
+ * by a maintainer when a phase legitimately relocates coupling, never to
+ * absorb new debt.
+ *
+ * Patterns cover the Host services the migration must isolate (the plan's
+ * coupling inventory): `ctx.get('service')`, `ctx.<service>` property
+ * access, and `@deepseek-ai/dsh-agent` / `@deepseek-ai/dsh-session` type
+ * imports (Agent / AgentHandle / Session). Cordis process services with no
+ * Host business state (`loader`, `appExit`) and the TUI's own services
+ * (`TUI_STARTUP_SERVICE`, `PI_TUI_EXTENSIONS_SERVICE`) are deliberately NOT
+ * patterns — they are not migration coupling.
+ *
+ * Usage:
+ *   node scripts/client-boundary-gate.mjs            # check (CI; exit 1 on new debt)
+ *   node scripts/client-boundary-gate.mjs --report   # print the current inventory
+ * @module client-boundary-gate
+ */
+
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
+import { join, relative, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+const BASELINE_PATH = join(ROOT, 'scripts', 'client-boundary-baseline.json')
+
+// Host services the migration must isolate. Keep in sync with
+// docs/client-server-coupling.md.
+export const HOST_SERVICES = [
+  'agents',
+  'sessions',
+  'subagents',
+  'jobs',
+  'credentials',
+  'userQuestions',
+  'agentPresets',
+  'sessionQuery',
+  'sessionPersistence',
+  'sessionTitle',
+  'commands',
+  'tools',
+  'skills',
+  'attachments',
+  'llm',
+  'settings',
+  'approval',
+  'authorization',
+  'permissionPresets',
+  'tokenMeter',
+  'agentDefaultModel',
+  'workspaceRegistry',
+  'directoryPicker',
+  'goal',
+  'planMode',
+  'sandboxPolicy',
+  'shell',
+]
+
+const SERVICE_ALT = HOST_SERVICES.join('|')
+const PATTERNS = [
+  // ctx.get('service') — the dominant access form in this codebase.
+  { key: (m) => m[1], re: new RegExp(`ctx\\.get\\(['"](${SERVICE_ALT})['"]`) },
+  // ctx.<service> property access (would throw without inject; still debt).
+  { key: (m) => m[1], re: new RegExp(`ctx\\.(${SERVICE_ALT})\\b`) },
+  // Concrete Host object types.
+  { key: () => 'import:dsh-agent', re: /@deepseek-ai\/dsh-agent/ },
+  { key: () => 'import:dsh-session', re: /@deepseek-ai\/dsh-session/ },
+]
+
+/** True when the line is (heuristically) inside a comment. */
+function isCommentLine(line) {
+  const t = line.trim()
+  return t.startsWith('*') || t.startsWith('//') || t.startsWith('/*') || t.startsWith('*/')
+}
+
+/**
+ * Scan a directory tree for Host-coupling patterns in non-comment code
+ * lines. Returns a map of `src/...`-style relative path -> Set of matched
+ * pattern keys (service names or import markers).
+ * @param {string} dir directory to scan
+ * @param {string} [base] base for relative paths (defaults to dir)
+ * @returns {Record<string, string[]>}
+ */
+export function scanTree(dir, base = dir) {
+  const out = {}
+  const walk = (d) => {
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const p = join(d, entry.name)
+      if (entry.isDirectory()) {
+        if (entry.name === 'node_modules' || entry.name === 'dist') continue
+        walk(p)
+      } else if (entry.name.endsWith('.ts') || entry.name.endsWith('.mts')) {
+        const rel = relative(base, p).split('\\').join('/')
+        const hits = new Set()
+        const lines = readFileSync(p, 'utf8').split('\n')
+        for (const line of lines) {
+          if (isCommentLine(line)) continue
+          for (const { key, re } of PATTERNS) {
+            const m = line.match(re)
+            if (m) hits.add(key(m))
+          }
+        }
+        if (hits.size > 0) out[rel] = [...hits].sort()
+      }
+    }
+  }
+  walk(dir)
+  return out
+}
+
+/** Load the checked-in baseline (missing file = empty baseline). */
+export function loadBaseline() {
+  if (!existsSync(BASELINE_PATH)) return {}
+  return JSON.parse(readFileSync(BASELINE_PATH, 'utf8'))
+}
+
+/**
+ * Compare a scanned inventory against the baseline. Returns the list of NEW
+ * (file, pattern) pairs — the no-new-debt violations.
+ * @param {Record<string, string[]>} scanned
+ * @param {Record<string, string[]>} baseline
+ * @returns {string[]}
+ */
+export function findNewDebt(scanned, baseline) {
+  const debt = []
+  for (const [file, patterns] of Object.entries(scanned)) {
+    const allowed = new Set(baseline[file] ?? [])
+    for (const pattern of patterns) {
+      if (!allowed.has(pattern)) debt.push(`${file}: ${pattern}`)
+    }
+  }
+  return debt
+}
+
+function main() {
+  const scanned = scanTree(join(ROOT, 'src'))
+  if (process.argv.includes('--report')) {
+    for (const [file, patterns] of Object.entries(scanned).sort()) {
+      console.log(`${file}: ${patterns.join(', ')}`)
+    }
+    console.log(`\n${Object.keys(scanned).length} file(s) with Host coupling.`)
+    return
+  }
+  const baseline = loadBaseline()
+  const debt = findNewDebt(scanned, baseline)
+  if (debt.length > 0) {
+    console.error('client-boundary-gate: NEW Host coupling outside the approved boundary:')
+    for (const d of debt) console.error(`  ${d}`)
+    console.error('\nSee AGENTS.md "Server/client migration guardrails" and docs/client-server-coupling.md.')
+    process.exit(1)
+  }
+  console.log(`client-boundary-gate: ok (${Object.keys(scanned).length} file(s), no new Host coupling)`)
+}
+
+if (process.argv[1] && relative(ROOT, process.argv[1]).replace(/\\/g, '/') === 'scripts/client-boundary-gate.mjs') {
+  main()
+}

package/scripts/pre-push-stages.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * Pre-push gate stage derivation — the single source of truth for what the
+ * husky pre-push hook runs stays in package.json's `verify:*` scripts; this
+ * module turns one of them into the ordered per-command stage list the hook
+ * executes with progress reporting.
+ *
+ * A script like `a && b && c` yields `['a', 'b', 'c']`. Only top-level `&&`
+ * separators are split (a `&&` inside quotes, e.g. inside a node -e snippet,
+ * is not a separator). A trailing `&&` (or a `&&` followed by nothing but
+ * whitespace) is rejected — `sh -e` treats such a line as a syntax error, so
+ * a split would silently drop the intended tail.
+ *
+ * Supported shell grammar (the parsed script must stay within this subset):
+ *   - commands chained with `&&` (the split points), each otherwise passed
+ *     verbatim to `sh -c` for execution — the splitter does NOT interpret
+ *     the commands themselves;
+ *   - single- and double-quoted strings anywhere in the script (quotes are
+ *     tracked so `&&` inside them is not a separator);
+ *   - backslash escapes inside and outside quotes: an escaped `&&` is NOT
+ *     treated as a separator (it stays inside the current stage, whose
+ *     shell semantics are then preserved unchanged by `sh -c`);
+ *   - anything the command segment may contain (redirects, env assignments,
+ *     pipes, subshells, `node -e "..."`, ...) is preserved verbatim and
+ *     executed by `sh -c` unchanged.
+ * NOT supported (the splitter rejects them loudly): unterminated quotes,
+ * dangling `&&`, empty commands (consecutive `&&`), empty scripts.
+ *
+ * Usage:
+ *   node scripts/pre-push-stages.mjs <verify-script-name>
+ *   # e.g. node scripts/pre-push-stages.mjs verify:prepush
+ *
+ * @module pre-push-stages
+ */
+
+import { readFileSync } from 'node:fs'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..')
+
+function fail(message) {
+  console.error(`pre-push-stages: ${message}`)
+  process.exit(1)
+}
+
+const [name] = process.argv.slice(2)
+if (!name || !name.startsWith('verify:')) {
+  fail(`usage: node scripts/pre-push-stages.mjs <verify-script-name> (got: ${name ?? 'none'})`)
+}
+
+const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'))
+const script = pkg.scripts?.[name]
+if (typeof script !== 'string' || script === '') {
+  fail(`package.json has no non-empty script "${name}" (update .husky/pre-push)`)
+}
+
+// Split on top-level `&&` only: walk the string tracking single-quote,
+// double-quote and backslash escapes; a `&&` seen at depth 0 (no open
+// quote) is a command separator. Escapes are honoured OUTSIDE quotes too
+// (`\&&` is an escaped literal `&`, not a separator), and a script with
+// an unterminated quote is rejected — sh would reject it as well.
+const stages = []
+let current = ''
+let quote = null
+for (let i = 0; i < script.length; i++) {
+  const ch = script[i]
+  if (quote === '"') {
+    if (ch === '\\') { current += ch + (script[i + 1] ?? ''); i++; continue }
+    if (ch === '"') quote = null
+    current += ch
+    continue
+  }
+  if (quote === "'") {
+    if (ch === "'") quote = null
+    current += ch
+    continue
+  }
+  if (ch === '\\') {
+    // Outside quotes: escape the next character (incl. `&`, so `\&&`
+    // stays literal). Keep the backslash in the fragment — it is
+    // meaningful to the shell that later runs the stage.
+    current += ch + (script[i + 1] ?? '')
+    i++
+    continue
+  }
+  if (ch === '"' || ch === "'") {
+    quote = ch
+    current += ch
+    continue
+  }
+  if (ch === '&' && script[i + 1] === '&') {
+    stages.push(current)
+    current = ''
+    i++
+    continue
+  }
+  current += ch
+}
+stages.push(current)
+
+if (quote !== null) {
+  fail(`script "${name}" has an unterminated ${quote === '"' ? 'double' : 'single'} quote — sh would reject it; fix package.json`)
+}
+
+const trimmed = stages.map((s) => s.trim())
+if (trimmed[trimmed.length - 1] === '') {
+  fail(`script "${name}" ends with a dangling "&&" — sh -e would reject it; fix package.json`)
+}
+for (const [i, stage] of trimmed.entries()) {
+  if (stage === '') {
+    fail(`script "${name}" has an empty command at position ${i + 1} (consecutive "&&")`)
+  }
+}
+
+process.stdout.write(trimmed.join('\n') + '\n')