@xmoon76/dsh-pi-tui 0.4.8 → 0.5.0

package/README.en.md

@@ -19,7 +19,7 @@ Stable releases are recommended for ordinary users. Install DSH first, then add
 the TUI to the `pi-tui` profile:
 
 ```sh
-npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty,@google/genai,protobufjs,fs-ext @deepseek-ai/dsh@latest
+npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty @deepseek-ai/dsh@latest
 dsh plugin --profile pi-tui -- add @xmoon76/dsh-pi-tui@latest
 dsh --profile pi-tui
 ```
@@ -30,7 +30,7 @@ Preview installation uses the DSH `alpha` channel and the TUI `next` channel.
 The DSH native install scripts must be explicitly allowed:
 
 ```sh
-npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty,@google/genai,protobufjs,fs-ext @deepseek-ai/dsh@alpha
+npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty @deepseek-ai/dsh@alpha
 dsh plugin --profile pi-tui -- add @xmoon76/dsh-pi-tui@next
 dsh --profile pi-tui
 ```
@@ -54,15 +54,19 @@ next compatibility range, and fallback paths.
 
 | TUI package line | Official DSH tags for the pairing | Notes |
 |---|---|---|
-| `0.4.8` (stable / `@latest`) | `dsh-v0.1.7-rc.1` | Current stable line; 0.1.7-rc.1 minimum |
+| `0.5.0` (stable / `@latest`) | `dsh-v0.1.7-rc.2`, `dsh-v0.2.0-rc.1` | Current stable line; 0.1.7-rc.2 minimum, exact validation target 0.2.0-rc.1 |
+| `0.4.9` (stable, previous) | `dsh-v0.1.7-rc.2` | Previous stable; the compatible TUI for a 0.1.7-rc.2 runtime |
+| `0.4.8` (stable, previous) | `dsh-v0.1.7-rc.1` | Previous stable; the compatible TUI for a 0.1.7-rc.1 runtime |
 | `0.4.6` (stable, previous) | `dsh-v0.1.5-rc.1`, `dsh-v0.1.5-rc.2` | Previous stable; the compatible TUI for a 0.1.5 runtime |
 | `0.4.7-alpha.2` (next, previous) | `dsh-v0.1.6-alpha.2` | Previous next line; the compatible TUI for a 0.1.6-alpha.2 runtime |
 
-Do not mix the stable and `@next` prerelease lines. The `0.4.8` line unifies its
-whole DSH peer floor at `>=0.1.7-rc.1` (the rc.1 preset registry peers
+Do not mix the stable and `@next` prerelease lines. The `0.5.0` line unifies its
+whole DSH peer floor at `>=0.1.7-rc.2` (the rc.2 preset registry peers
 `dsh-agent` exactly, so a wider legacy floor no longer satisfies a standalone
-tarball install); older runtimes fail at the normal incompatible-runtime
-boundary, so install the paired TUI line from the table above. The startup notice
+tarball install), while its exact validation and recommended upgrade target is
+the published `0.2.0-rc.1` family; older runtimes fail at the normal
+incompatible-runtime boundary, so install the paired TUI line from the table
+above. The startup notice
 is best-effort rather than a Loader startup-order guarantee. See the [full
 historical compatibility matrix](docs/dsh-compatibility.md) for official-tag
 pairings and fallback commands, and see the [latest `next`
@@ -174,10 +178,31 @@ History results include the Prompt, working directory, timestamp, and Session in
 
 Regular `↑` / `↓` history recall is still available for recent input.
 
-### Subagents and background tasks
-
-`/tasks` opens the full Task Center for all background work in the current
-Session; the Footer's `↓` opens the lightweight Quick Tasks view for running work.
+### Subagents and the Task Center
+
+`/tasks` opens the full Task Center, showing the work the current Session's
+Job Registry / Subagent catalog still tracks; the Footer's `↓` opens the
+lightweight Quick Tasks view for the current active work. Selecting a Job
+opens a detail with the official non-consuming live
+output preview (status, progress and the retained output tail); it never consumes
+the model's `job_output` cursor and never becomes session history.
+
+Task Center is a live tracked/control projection, not an execution-history
+list. `ACTIVE` / `TRACKED` are presentation scopes: `ACTIVE` shows only the
+currently active items, `TRACKED` shows everything the current authority
+still lists. DSH `0.1.7` temporarily registers a Job while an ordinary
+foreground `bash` / `pwsh` command runs, so it can be observed and stopped
+from the Task Center; if the command finishes inside the foreground wait,
+DSH removes that temporary record and the final result stays in the
+Transcript's tool card. Explicit `run_in_background: true` jobs (and jobs
+promoted to the background after a foreground timeout) remain visible in
+`TRACKED` after completion as long as the Job Registry keeps their record.
+
+`/plugins` opens the active profile's Plugin Manager: installed bundles and
+plugins are grouped into Current TUI / TUI Extensions / DSH Plugins, with
+enable/disable, remove and install; the `dsh-pi-tui` bundle currently providing
+the surface is read-only and cannot be disabled or removed from its own screen.
+The `Plugins  Manage…` row in `/settings` opens the same surface on demand.
 
 Subagents are shown using their complete lineage, including nested descendants:
 
@@ -194,14 +219,14 @@ The browser distinguishes:
 * `one-shot`
 * running / inactive
 * nested descendants
-* background Jobs
+* Job Registry rows (including running foreground shell work)
 
 The Footer's `↓` opens Quick Tasks as a lightweight browsing view: it only
 supports arrow navigation, left/right expand/collapse, `Tab` type cycling,
 `Enter` open, and `Esc` close. The bottom “Open Task Center” row opens the full
 Task Center.
 
-The full Task Center additionally offers `A` to toggle Active / All, `/` search,
+The full Task Center additionally offers `A` to toggle Active / Tracked, `/` search,
 `Tab` / `Shift+Tab` to cycle types in both directions, `S` to stop the selected
 task after confirmation, and `R` to refresh/retry. Quick Tasks consumes only the
 whitelist above; every other keystroke is a no-op that never enters search, stop
@@ -573,8 +598,9 @@ This section contains DSH compatibility and CI validation details only; ordinary
 ### npm mode (current `next`)
 
 The current compatibility-train line is npm mode: it targets the published
-`dsh-v0.1.7-rc.1` family declared by this checkout's `package.json` and
-resolved by its lockfile. The isolated npm driver installs that exact
+`dsh-v0.2.0-rc.1` family declared by this checkout's `package.json` and
+resolved by its lockfile (the runtime peer floor stays `>=0.1.7-rc.2`). The
+isolated npm driver installs that exact
 family from the public registry and exercises the TUI build/test/package path:
 
 ```sh

package/README.md

@@ -18,7 +18,7 @@
 稳定版是普通用户的推荐渠道。请先安装 DSH，再将 TUI 添加到 `pi-tui` profile：
 
 ```sh
-npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty,@google/genai,protobufjs,fs-ext @deepseek-ai/dsh@latest
+npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty @deepseek-ai/dsh@latest
 dsh plugin --profile pi-tui -- add @xmoon76/dsh-pi-tui@latest
 dsh --profile pi-tui
 ```
@@ -29,7 +29,7 @@ dsh --profile pi-tui
 时需要显式允许其原生安装脚本：
 
 ```sh
-npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty,@google/genai,protobufjs,fs-ext @deepseek-ai/dsh@alpha
+npm install -g --allow-scripts=@deepseek-ai/dsh-subprocess-local,koffi,node-pty @deepseek-ai/dsh@alpha
 dsh plugin --profile pi-tui -- add @xmoon76/dsh-pi-tui@next
 dsh --profile pi-tui
 ```
@@ -52,13 +52,16 @@ pnpm compat:dsh:npm
 
 | TUI 包版本 | 对应的官方 DSH tags | 说明 |
 |---|---|---|
-| `0.4.8`（stable / `@latest`） | `dsh-v0.1.7-rc.1` | 当前稳定版；最低 0.1.7-rc.1 |
+| `0.5.0`（stable / `@latest`） | `dsh-v0.1.7-rc.2`、`dsh-v0.2.0-rc.1` | 当前稳定版；最低 0.1.7-rc.2，精确验证目标 0.2.0-rc.1 |
+| `0.4.9`（stable，历史） | `dsh-v0.1.7-rc.2` | 上一稳定版；0.1.7-rc.2 runtime 的兼容 TUI |
+| `0.4.8`（stable，历史） | `dsh-v0.1.7-rc.1` | 上一稳定版；0.1.7-rc.1 runtime 的兼容 TUI |
 | `0.4.6`（stable，历史） | `dsh-v0.1.5-rc.1`、`dsh-v0.1.5-rc.2` | 上一稳定版；0.1.5 runtime 的兼容 TUI |
 | `0.4.7-alpha.2`（next，历史） | `dsh-v0.1.6-alpha.2` | 上一条 next 线；0.1.6-alpha.2 runtime 的兼容 TUI |
 
-不要把稳定线与 `@next` 预发布线混装。`0.4.8` 的整个 DSH peer floor 统一为
-`>=0.1.7-rc.1`（rc.1 的 preset registry 精确 peer `dsh-agent`，更宽的旧
-floor 已无法满足独立 tarball 安装）；旧 runtime 会在正常的不兼容边界以非零状态失败，
+不要把稳定线与 `@next` 预发布线混装。`0.5.0` 的整个 DSH peer floor 统一为
+`>=0.1.7-rc.2`（rc.2 的 preset registry 精确 peer `dsh-agent`，更宽的旧
+floor 已无法满足独立 tarball 安装），精确验证与推荐升级目标是已发布的
+`0.2.0-rc.1` family；旧 runtime 会在正常的不兼容边界以非零状态失败，
 请按上表安装配对的 TUI 线。完整的历史兼容矩阵和 fallback 命令见
 [兼容性文档](docs/dsh-compatibility.md)；要查看 `@next` 的最新集成状态，请看
 [next 分支 README](https://github.com/XMoon/dsh-pi-tui/blob/next/README.md)。
@@ -167,9 +170,13 @@ Rewind 会从选中的历史 User Turn 创建新的 Child Session，并把对应
 
 普通的 `↑` / `↓` 仍用于快速浏览最近输入。
 
-### Subagent 与后台任务
+### Subagent 与 Task Center
 
-`/tasks` 打开完整 Task Center（当前 Session 的所有后台工作）；Footer 的 `↓` 直接打开轻量 Quick Tasks（只看正在运行的工作）。
+`/tasks` 打开完整 Task Center，显示当前 Session 中仍由 Job Registry / Subagent catalog 跟踪的工作；Footer 的 `↓` 打开轻量 Quick Tasks，只看当前活动（active）工作。选中 Job 后，详情会显示官方非消耗式的实时输出预览（状态、进度与保留的输出尾部），不会消耗模型的 `job_output` 游标，也不写入会话历史。
+
+Task Center 的 `ACTIVE` / `TRACKED` 是展示范围：`ACTIVE` 只显示当前活动项，`TRACKED` 显示当前跟踪源（Job Registry / Subagent catalog）仍列出的全部项；`TRACKED` 不是 Session 执行历史。DSH `0.1.7` 会在普通前台 `bash` / `pwsh` 执行期间临时注册 Job，使其可以在 Task Center 中观察和停止；如果命令在前台等待内完成，DSH 会移除该临时记录，最终结果仍保留在 Transcript 的 tool card 中。显式 `run_in_background: true` 或被提升为后台的 Job 在完成后，只要 Job Registry 继续保留其记录，就仍可在 `TRACKED` 中查看。
+
+`/plugins` 打开当前 profile 的 Plugin Manager：按 Current TUI / TUI Extensions / DSH Plugins 分区查看已安装的 bundle 与插件，并执行启用/禁用、删除与安装；正在提供当前界面的 `dsh-pi-tui` 只读且不可从自身界面禁用或移除。`/settings` 中的 `Plugins  Manage…` 按需打开同一界面。
 
 Subagent 按完整 lineage 显示，包括嵌套创建的 descendant：
 
@@ -186,11 +193,11 @@ main
 * `one-shot`
 * running / inactive
 * nested descendant
-* 后台 Job
+* Job Registry 跟踪的 Job（含运行中的前台 shell）
 
 Footer `↓` 打开的 Quick Tasks 是轻量浏览视图，只提供方向键导航、左右展开/折叠、`Tab` 类型过滤、`Enter` 打开和 `Esc` 关闭。底部 “Open Task Center” 行可进入完整 Task Center。
 
-完整 Task Center 额外提供 `A` 切换 Active / All、`/` 搜索、`Tab` / `Shift+Tab` 双向切换类型、`S`（确认后）停止所选任务以及 `R` 刷新 / 重试。Quick Tasks 只消费上述白名单按键，其余输入一律 no-op，不会进入搜索、停止确认或任务管理状态，因此 `Esc` 始终一层关闭。
+完整 Task Center 额外提供 `A` 切换 Active / Tracked、`/` 搜索、`Tab` / `Shift+Tab` 双向切换类型、`S`（确认后）停止所选任务以及 `R` 刷新 / 重试。Quick Tasks 只消费上述白名单按键，其余输入一律 no-op，不会进入搜索、停止确认或任务管理状态，因此 `Esc` 始终一层关闭。
 
 已经结束的 one-shot Subagent 仍可以打开并查看持久化 Transcript。
 
@@ -544,7 +551,8 @@ dsh --profile pi-tui-dev
 ### npm 模式（当前 `next`）
 
 当前兼容列车线是 npm 模式：以本 checkout 的 `package.json` 声明、
-lockfile 解析的已发布 `dsh-v0.1.7-rc.1` family 为兼容目标。隔离的 npm
+lockfile 解析的已发布 `dsh-v0.2.0-rc.1` family 为精确验证目标（运行时
+peer floor 保持 `>=0.1.7-rc.2`）。隔离的 npm
 驱动从公共 registry 安装该精确 family，并跑完整 build/test/package 路径：
 
 ```sh

package/cordis.patch.yml

@@ -32,10 +32,25 @@
       # can fork. The row below is this bundle's own, so the dependency is
       # self-contained and a profile that disables it fails loud instead of
       # silently forking without workspace inheritance.
-      inject: [tuiStartup, piTuiExtensions, authorization, workspaceRegistry]
+      # `pluginManager` is injected for the P1-A Plugin Manager surface: the
+      # dsh-base layer already mounts it (disabled only without a profile),
+      # so this is an explicit lifecycle ordering dependency, never a second
+      # package-manager row.
+      inject: [tuiStartup, piTuiExtensions, authorization, workspaceRegistry, pluginManager, jobController]
       config:
         sessionId: ''
 
+    # One background Job's observation stream (P1-B): the official Host
+    # controller wraps `jobs.events` + `jobs.readAt()` into a
+    # NON-CONSUMING follow stream (never `jobs.read()`), so the selected Job
+    # detail can render a live retained-output tail without touching the
+    # model's `job_output` cursor or completion notices. The rc.1 web bundle
+    # mounts this same row; the dsh-base layer does not, so the TUI inserts
+    # it. This is NOT M3: same process, same Host Context, no Client Context,
+    # no Connection, no transport.
+    - id: job-controller
+      name: '@deepseek-ai/dsh-api-job-controller'
+
     # Host-owned workspace membership (`ctx.workspaceRegistry`): D2.4 Direct
     # fork mirrors the official Host rule (use the source's directly owning
     # workspace, else the nearest ancestor workspace of a subagent source) and
@@ -74,6 +89,39 @@
       config:
         default: standard
 
+    # Production hardening for per-session preset composition. A live Agent
+    # whose standing preset generation disappears (the DSH registry owns that
+    # lifetime; the TUI must not remount/reparent/recreate an Agent) would
+    # otherwise keep addressing the model with only its Agent-own rows — the
+    # observed failure mode was a request whose tool list had collapsed to
+    # `subagent` alone, with no error anywhere. This official companion turns
+    # that into a loud, early failure at the next prompt assembly instead.
+    #
+    # The allowlist is deliberate and minimal: this bundle introduces exactly
+    # ONE production invariant, so a future layer shipping another invariant
+    # companion cannot silently enable itself here. The companion's own
+    # `/invariant` entry declares `inject = ['invariants']`; no second
+    # dependency management is written here.
+    #
+    # DEPENDENCY CONTRACT: `@deepseek-ai/dsh-invariants` is a COMPOSITION row
+    # resolved by the dsh Host (the package ships inside the dsh installation),
+    # not a module-graph peer — exactly like `@deepseek-ai/dsh-agent-preset`,
+    # which the same rule keeps in devDependencies. It therefore carries an
+    # exact devDependency pin for the real-mount tests and deliberately NO
+    # peerDependency: `scripts/naming-gate.mjs` rejects a `@deepseek-ai/*` peer
+    # that `src/` never imports as a dead peer, and a phantom peer would invite
+    # duplicate in-box copies in the profile. The companion subpath below is
+    # covered by the registry's own runtime peer.
+    - id: invariants
+      name: '@deepseek-ai/dsh-invariants'
+      config:
+        enabled: true
+        package_allowlist:
+          - '^@deepseek-ai/dsh-agent-preset-registry$'
+
+    - id: agent-preset-registry-invariant
+      name: '@deepseek-ai/dsh-agent-preset-registry/invariant'
+
     # The official standard preset composes its `subagent` tool with
     # `modelSelectionSettings: true`, which injects this Host-owned setting
     # service — the row is required for the standard composition to mount.

package/dist/builtins.mjs

@@ -1,5 +1,6 @@
-import { B as PI_TUI_EXTENSIONS_SERVICE, I as dshVersion } from "./src-R8SVGB-L.mjs";
-import { n as TUI_STARTUP_SERVICE } from "./startup-Cd07dCyh.mjs";
+import { n as TUI_STARTUP_SERVICE } from "./startup-DM-xxzcX.mjs";
+import { i as PI_TUI_EXTENSIONS_SERVICE } from "./extensions-Dg1qhjUi.mjs";
+import { n as dshVersion } from "./dsh-version-V0exEv9O.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/builtins.ts

package/dist/dsh-version-V0exEv9O.mjs

@@ -0,0 +1,76 @@
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+//#region src/dsh-version.ts
+/**
+* The installed dsh (DeepSeek Harness CLI) version, resolved from the
+* launcher's real path: `process.argv[1]` is the `dsh` bin, whose realpath
+* walks up to the `@deepseek-ai/dsh/package.json` that owns it. The header
+* and the welcome card show the harness the TUI runs on, not this bundle's
+* own patch level. Undefined when the launcher path is unreadable.
+*
+* The module also owns the bundle's OWN version reads (`bundleVersion`) and
+* the combined welcome-card display line (`versionDisplay`).
+* @module @xmoon76/dsh-pi-tui/dsh-version
+*/
+/** @returns the installed dsh version string, or undefined. */
+function dshVersion() {
+	const bin = process.argv[1];
+	if (bin === void 0) return void 0;
+	try {
+		let dir = dirname(realpathSync(bin));
+		for (let depth = 0; depth < 8; depth += 1) {
+			try {
+				const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+				if (pkg.name === "@deepseek-ai/dsh" && typeof pkg.version === "string") return pkg.version;
+			} catch {}
+			const parent = dirname(dir);
+			if (parent === dir) return void 0;
+			dir = parent;
+		}
+	} catch {}
+}
+/**
+* The bundle's own version, read from package.json at runtime so the welcome
+* card never drifts from the shipped version. The DISPLAYED version prefers
+* the installed dsh version (`dshVersion` — shared with the header badge
+* via src/dsh-version.ts), falling back to this one.
+* @returns the version string, or a fallback when the file is unreadable.
+*/
+function packageVersion() {
+	try {
+		const pkg = JSON.parse(readFileSync(join(import.meta.dirname, "..", "package.json"), "utf8"));
+		return dshVersion() ?? pkg.version ?? "0.0.0";
+	} catch {
+		return dshVersion() ?? "0.0.0";
+	}
+}
+/**
+* The welcome card's version line: the installed dsh version plus the
+* bundle's own version (header-badge parity — `dsh-0.1.7-rc.2 ·
+* tui-v0.4.9`). Without a resolvable dsh launcher it degrades to
+* the bundle version alone.
+* @returns the combined version string.
+*/
+function versionDisplay() {
+	const dsh = dshVersion();
+	return dsh === void 0 ? `tui-v${bundleVersion()}` : `dsh-${dsh} · tui-v${bundleVersion()}`;
+}
+/**
+* The BUNDLE's OWN version (`@xmoon76/dsh-pi-tui`'s package.json),
+* INDEPENDENT of the installed dsh version. The status snapshot's
+* host.tuiVersion and the footer's `version(format=tui)` item must report
+* the TUI's own patch level — the welcome-card helper above deliberately
+* prefers the dsh version for display, so reusing it made `tui` show the
+* harness version (and `both` show the dsh version twice) inside a real
+* dsh installation (the review's P2).
+* @returns the bundle version string, or a fallback when the file is unreadable.
+*/
+function bundleVersion() {
+	try {
+		return JSON.parse(readFileSync(join(import.meta.dirname, "..", "package.json"), "utf8")).version ?? "0.0.0";
+	} catch {
+		return "0.0.0";
+	}
+}
+//#endregion
+export { versionDisplay as i, dshVersion as n, packageVersion as r, bundleVersion as t };